{ "Event": { "published": true, "date": "2021-04-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-14", "timestamp": 1618444982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9c1281b8-7d89-4065-88c8-1f253012379c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1aa972-9cee-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618383557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383557, "uuid": "25e40b5e-44ec-4cd1-9294-6b2814dd198d", "comment": "Malware payload (SnakeKeylogger)", "value": "86d93b2f2b5c08337d1e2882ad441d51", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383557, "uuid": "2b021638-202e-4f5e-8745-2394aca0310b", "comment": "Malware payload (SnakeKeylogger)", "value": "018cfbeb6f155503fbe7a7e4dfd09f899fcf8d96ad8711b9295153b66945381d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383557, "uuid": "0d23aa82-7939-46eb-93be-8e9851d6f189", "comment": "Malware payload (SnakeKeylogger)", "value": "b6f379f407682c5fce267afddb49256b49e85aa8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383557, "uuid": "54e36c19-5e61-437c-821f-451bb91e0563", "comment": "Malware payload (SnakeKeylogger)", "value": "7c2f565cd762b341be72fd971c704764dd2a0f36301b75eae5b4c2b5c07568ab804c17892e92c2f5763fba3d0759f5c1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383557, "uuid": "88856494-d42e-4785-b3df-51e78451137c", "value": "26E48CB822066D56E67F2E721B0FF09D6A1FF12864E04CA4F16EF3BC23EA554E217055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383557, "uuid": "3cee4fb3-4145-4aeb-bd0d-46df4429662f", "value": "6144:D1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1PB1P8:WgOdNMDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618383557, "uuid": "45670438-f20e-4180-be2b-fe9fa37e941d", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618383557, "uuid": "5770a076-98c4-4e59-bd59-4a2cee6f4eae", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383557, "uuid": "a7c98734-271f-4e0a-9644-ad877345bc77", "value": "IMG_107_85_02_37.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c05656-9ce3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618378849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378849, "uuid": "bff655c0-b51b-4f10-a4e4-798c32db9bfa", "comment": "Malware payload", "value": "0433e8c3aeae9bb101a178a122c0ec5d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378849, "uuid": "89d90177-e0be-4d59-a63e-fd5cf0040160", "comment": "Malware payload", "value": "01998d6e433b1ea41d7cd1528a79da62a91dd4533d6b8d2e5923d40360c343cf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378849, "uuid": "17697b78-0aad-4af3-a18e-246de2a38611", "comment": "Malware payload", "value": "330fce8332a630a3f40fdaea1b71990e6a318c14", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378849, "uuid": "dab5fd3c-fccf-46f8-b3e6-65c229629293", "comment": "Malware payload", "value": "ea5d60ebe06fc8418000d9c5144de3aede37a719a8ad0b2a5431e2cff1445400786c8714d70c42600a5bf1a8efbdcba2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378849, "uuid": "8c174921-5c96-4da3-a11b-3232697eafc9", "value": "7DF533622BD3D27D91A8B4868DCF4CC99D6F4BC4B8F798F28A4FCA379A142D85042157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378849, "uuid": "469fde0e-d532-4de0-ad0b-14b51800f19e", "value": "98304:6vK2qpzTON3FR4LDNsWRi/0OnSuPg9PhKip/:TpzThLDNsuidn7g9JRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618378849, "uuid": "7d82d93c-20f3-444c-92ab-8139e9551a2e", "value": 3430765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618378849, "uuid": "77541526-a377-4872-89bc-3ed20ad87f43", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378849, "uuid": "7a7ecfaf-59e3-4635-813f-64d31bd9592b", "value": "dhl.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefaee81-9d4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618423878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423878, "uuid": "5b5c2613-c02b-4764-a3f1-da9f6bec319a", "comment": "Malware payload (AgentTesla)", "value": "01bde51fb30a013b7536dc7d45ea4a0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423878, "uuid": "347800f0-14ab-4537-afdb-c537ab31cdaf", "comment": "Malware payload (AgentTesla)", "value": "024da5bcb62d3a21ab2e55db0c3a600f29778c43eb00a7246a61037c6e55c018", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423878, "uuid": "f53f9ead-88d3-4123-95b1-2bead45fd5df", "comment": "Malware payload (AgentTesla)", "value": "38aff2b047cb43d0158f7d35d10e76aadfa9ac14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423878, "uuid": "fb546f12-f077-4cd1-b636-ad00d1c16534", "comment": "Malware payload (AgentTesla)", "value": "f0c480ccc00da86ceb6d2e37a3ad5eeb76ca4b338f5f4a910a018e298e50c5ba0a5e63e9d7a49fa440eb9dc5dff4d2c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423878, "uuid": "e6d9e65a-a576-47cd-84ce-50400c66e4d0", "value": "27F43346B9E11ABC82EAF55F128C93D4E50E89E8C5395B116D22602E77DC2A9F37F103", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423878, "uuid": "6d249514-973b-4177-945c-5a712761a60b", "value": "12288:mRxGAUoCnlIYZWpyXnBw/SgZNFXU2Br93W9qjarlegc0hdzv5it:mR0LozaXCagZbXU3q+rlFc8zvot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618423878, "uuid": "4622a6c4-de91-40df-98f2-643880f73c68", "value": 750588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618423878, "uuid": "f0ff6b7a-2d6b-419b-9e0e-7d9af410b4c4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423878, "uuid": "412990d0-4521-4aa6-9bea-7474f028bca7", "value": "#10001210.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a194353-9d7b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618443921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443921, "uuid": "edb1610e-4128-4014-9808-a7237b0e3700", "comment": "Malware payload", "value": "2570236fe07e597b3abe7062a10359dc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443921, "uuid": "ce552e7c-9b4d-46ee-a7e2-5bef58f2f975", "comment": "Malware payload", "value": "02636ae70ae9de38c0ceb8121f73e7b3cfe3653015c77815858a696fb66a47af", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443921, "uuid": "a10cb3c8-e9b9-4e38-8b89-428765d4b1f3", "comment": "Malware payload", "value": "8726a2e4366b90857f8ca169c593e4c6618d9234", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443921, "uuid": "05af10e7-b859-4b77-bbc8-2b06565ddda9", "comment": "Malware payload", "value": "6a064f37e137501745c104baa20abf1828ad2723bbd19cec3bf6ddfdb607fe6ebd690944810d11dd80ca07e1d0e2ad2a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443921, "uuid": "93080be1-d3bc-425d-93a4-fe116dc78987", "value": "34249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443921, "uuid": "f90fcd8e-e91c-49bd-a141-27d534da81c0", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443921, "uuid": "35cdc726-775b-4491-93bd-d12dacc80fac", "value": "3072:n0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:GpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618443921, "uuid": "5947b87a-cc37-4817-99e7-13d9caf816eb", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618443921, "uuid": "f380b7ad-581a-485b-be69-3fc9dd94443e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443921, "uuid": "d7b71ac6-841f-4236-bcd4-c128ff83d789", "value": "02636ae70ae9de38c0ceb8121f73e7b3cfe3653015c77815858a696fb66a47af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15825be8-9d5a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618429579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429579, "uuid": "3a338f7c-5109-4b2a-8e19-8ea475dd0091", "comment": "Malware payload", "value": "ad46f799b7f135bd7507c3b1a65b4352", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429579, "uuid": "009ef4ed-ff1f-4f4f-9796-2243fbe18a12", "comment": "Malware payload", "value": "038f4b15975fcd70bc79f4c71b5aa69db6f487076c02475315509e3980013caa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429579, "uuid": "be8237b8-8a23-483c-a1e6-d750977f53f8", "comment": "Malware payload", "value": "fbcd839c661aa4416f122ecab3f5c04da7cd7185", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429579, "uuid": "399dbd09-1dac-4df3-adfe-e3ca634708d0", "comment": "Malware payload", "value": "bf50f62fead559c118b72b77fcdf911d22e90437eb725a321ebbf34309efb37e10f0c547f4458c9a15cff7f78d74934d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429579, "uuid": "6d063973-a8da-4a95-bc83-f8a3971937ac", "value": "DE249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429579, "uuid": "bb2ede97-d568-46b8-9238-a007443ecba3", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429579, "uuid": "1b606f83-d86e-4eca-bc0f-918fa23cfc52", "value": "3072:R0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:EpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618429579, "uuid": "fb1d8d92-452d-44c0-8b08-719c199a1999", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618429579, "uuid": "b66ba160-2396-4265-b59c-5146b25d700c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429579, "uuid": "84db9032-e88e-4c19-8f4d-eb398190f5a3", "value": "038f4b15975fcd70bc79f4c71b5aa69db6f487076c02475315509e3980013caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d7f2fb-9d64-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618433982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433982, "uuid": "98d1444b-5480-4a33-b943-4ff18f4e24ca", "comment": "Malware payload", "value": "53f240ef6846dc74330a6d02f571e3e1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433982, "uuid": "d3d0fdcd-b790-459f-b227-c99954aeafa0", "comment": "Malware payload", "value": "03ca5b30974d1ba494fc5930a9ae195a12f1e6ea21edb2a9c382341e24254790", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433982, "uuid": "76b728c7-96e1-41bc-8b8b-a36376fab4f2", "comment": "Malware payload", "value": "50d662697e0a3b46cb07ed4719a6d3aa8ef5e20f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433982, "uuid": "0b2bfe03-ae10-4990-9f44-2e136b2990e1", "comment": "Malware payload", "value": "acf76076b5608390c77039176fc7c4d141df16840ffb524ce392b2b7023738f293cdd4dd0aa12e9ca080285a56527c83", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433982, "uuid": "cf1dff28-f1ff-4356-bf87-d9c240ab2c18", "value": "9E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433982, "uuid": "5fac15ba-5cfb-4d2c-8632-df0134eb2054", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433982, "uuid": "d5a9245d-3e3e-4e38-bd2f-058bd44909a2", "value": "3072:v0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:upepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618433982, "uuid": "2aa70478-909b-4ebe-91cb-154b5e6502f9", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618433982, "uuid": "e50c3503-893d-484d-a226-06c529db171d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433982, "uuid": "2bc54c03-a6d6-4b7d-a974-68045fb67764", "value": "03ca5b30974d1ba494fc5930a9ae195a12f1e6ea21edb2a9c382341e24254790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf40a5c7-9ce9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618381358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381358, "uuid": "6c1a033a-d5f4-43bf-a0c4-6a62d6bc6e36", "comment": "Malware payload (AgentTesla)", "value": "a76b0c5fbcac1868f76b0f975fe0a530", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381358, "uuid": "a457729f-e323-4585-a934-4e8197970808", "comment": "Malware payload (AgentTesla)", "value": "0458c61b6e0f70da8223db3b10ee6eaed0780901dee7743d137ab6e09546e6fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381358, "uuid": "7902e2d2-591b-4979-bbda-6460af73c507", "comment": "Malware payload (AgentTesla)", "value": "92b1c0140a3ea28ab300b72db28b86d681101f98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381358, "uuid": "e787820d-8047-4103-9203-adf18e8e3aa5", "comment": "Malware payload (AgentTesla)", "value": "a10759eb1f3f3e131eca848c90b944af746e1912f92db62daf7befc5970a058046ddd5dd5e175330ceace97bd4ef1606", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381358, "uuid": "96077fc3-fa3e-4de6-8ef9-08820de5dc18", "value": "4625AE1327D56E09E37CCFB69822A030DBE4EE473E16DA971DC53DC831B9B109622E59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381358, "uuid": "3afd2857-ff24-489c-81d9-70983566dc8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381358, "uuid": "7a9a3401-b255-4634-b4f6-4225b6964db0", "value": "24576:/QnMkVHhxo/lcDAQeh4UJJGMfkpGqId3b5y+Vkp9:/9kVBQ4AQe6U6MfdVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618381358, "uuid": "31754b95-0511-4eb8-b16b-9ebf80004b22", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618381358, "uuid": "6405a091-371c-472d-8fb1-d8b054f2860b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381358, "uuid": "0ee83fea-5554-4206-9bbe-058a10a9775c", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2dd9fd6-9d5c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430756, "uuid": "ae8518e6-900c-4f1c-a972-64bc7742818e", "comment": "Malware payload", "value": "f1b5707a91dc56ec33709735482fec45", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430756, "uuid": "96431ce7-4a9d-4bc8-a49e-c82f689a5f4c", "comment": "Malware payload", "value": "048906257a2dc084ff3d05c657c5cdec454a4c0d1cf43b4db22dd0a16ade4c6a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430756, "uuid": "c6f0f1fc-d3c5-4d3a-a27e-25ef71512403", "comment": "Malware payload", "value": "1a6127494fddd809150ba7e1654425e57f256a54", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430756, "uuid": "cdd5e4bc-3624-4fb7-8561-f4044fd58c4e", "comment": "Malware payload", "value": "1fac38d353388c773bd79e9dcfcb1c3d2b1ef73a8af3682ecb6b8d2db5afc728a8da01aee05d64baf27d1e7890a11187", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430756, "uuid": "29dbfd07-2007-428b-818b-ae979d825eec", "value": "AF44122DF5F91491E7B3DC3C30599ECB8BB066A8FC49D02B288AD8C5772E5B31316168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430756, "uuid": "fb2815a9-09b9-49a7-9fb5-b96e0a4f8845", "value": "6144:aQVR36Zyh2wDX7RWo2k8wGoDqKzyyoNE+W0WxwpFti:ZwZyh7DvL8pCvwpFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430756, "uuid": "24c6bd22-c411-43db-b46d-04aefafa1a94", "value": 265635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430756, "uuid": "2e797ba9-c4cf-4d4d-a74b-afaecdbf8865", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430756, "uuid": "857351dc-21d3-4fac-9aca-322dfdc4faff", "value": "SecuriteInfo.com.VBA.Amphitryon.166.20674.2063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb78e0cb-9d43-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420006, "uuid": "b9eedfaa-4f14-4139-bb70-9062f1f50c2d", "comment": "Malware payload", "value": "164c891971e45729f560b97920918b8c", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420006, "uuid": "4ba99740-dcb3-4e52-9c2f-7a9aece333fd", "comment": "Malware payload", "value": "062afcd9121c2ab718bb9a16097c4b7070e86a288669b0d874889bcfe7dda95d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420006, "uuid": "08f1f2e3-754f-4c71-8307-12cf6fe5d5b8", "comment": "Malware payload", "value": "58a328fa58fe8fee1a8c1765d6a26fd64fef050d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420006, "uuid": "364c67d5-c65b-4508-b73b-ce3b7efea378", "comment": "Malware payload", "value": "197983e882b0a6ec3738e76452c7fefab8922fb4c4933fccf7a72944d1b044986c3aaa1ccf7b89ea727c3fd1f965ff08", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420006, "uuid": "506881c8-520c-4734-b47b-868a14675fd4", "value": "05F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420006, "uuid": "6a882cd1-6d5d-4afa-89d7-3bd97440a5ac", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420006, "uuid": "65729dbf-74c3-4fb1-846b-4486a83008f1", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420006, "uuid": "b7afd01a-db5b-4495-9906-7e5041b962df", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420006, "uuid": "3aef69c4-98ce-4bf3-a4dd-dca9e9cd84b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420006, "uuid": "639de267-caab-4ed2-bbfc-c0db2f7f24f1", "value": "062afcd9121c2ab718bb9a16097c4b7070e86a288669b0d874889bcfe7dda95d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5d3550-9d41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419073, "uuid": "b1e31a57-2754-4c07-ac60-87572eff1df0", "comment": "Malware payload", "value": "94d143f2e66e3a741f50da8dc2ac00de", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419073, "uuid": "e3c644a0-2abc-4fb5-b3e6-5d9baea8fd53", "comment": "Malware payload", "value": "07404e970a44aca7a063ab284b3ebaabf212ead386b6ad15f1046318cd55ecb2", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419073, "uuid": "6be80d1e-db96-42d3-996c-4a0deb33754a", "comment": "Malware payload", "value": "f1b97ca404053a25df45f4d7562ec63b28ecb2e8", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419073, "uuid": "e6ac65e7-ab13-4d5c-8fb0-73c9abbccffe", "comment": "Malware payload", "value": "3bbe8d2c6d7b71c94e8240a8ac4871d153db3628eedf3b33d98412a7805aeea6ae33cdece894df8da9219e2a17868c71", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419073, "uuid": "9ebb1b06-5312-4d23-a1b2-a79b1fad8534", "value": "90241280CE9A5E90AAEE0472000773E059AA515FC81529ED65C8F28DD5FF87D2C3F7B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419073, "uuid": "ae386355-3031-4d5b-b9cd-2d39ccca474e", "value": "6144:kKqieqwAUKb0GKTEoyx6xBXuZ0ydT7zNTHdB:kpi7wKb0RNsmXuZ9NTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419073, "uuid": "2e575167-ae70-4dac-8567-5b35e3ef446d", "value": 217326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419073, "uuid": "7bedc631-5be1-45d4-a1c1-e025d0ca888e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419073, "uuid": "eb539f43-389e-440f-a530-4a60a4d5f273", "value": "SWIFT COPY (1).pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b75d68-9d49-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618422661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422661, "uuid": "a1e0cd31-0328-4db0-a2f3-6d64c53bb2bf", "comment": "Malware payload", "value": "d4f57bb21abe29930a5a96ba134796c9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422661, "uuid": "6ae5e6b7-70cb-4587-aa87-f49b7732f3b3", "comment": "Malware payload", "value": "074964b86a1c924b270e603ea110753ea97d2d7146f524914f572d745ccd6eaf", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422661, "uuid": "7fc835e3-7296-4733-8248-34d052043f5d", "comment": "Malware payload", "value": "28c387c7fcdb572b3fbc3ce4fa49a73eb3d4a9e9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422661, "uuid": "42090b5d-b986-4176-8e86-3e34b7305046", "comment": "Malware payload", "value": "03fa8ce20fffaf982d548ebeec594d780b130e77d84030a43261ad1cb31b9eb4a41cd6770eefb66d13e43641b89ce39a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422661, "uuid": "1135a8da-f7c2-4a90-94fd-ff42a5444fcd", "value": "22249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422661, "uuid": "0fd260b5-6268-4f18-87fd-667cda3f02fa", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422661, "uuid": "7a94a469-ac07-4d1a-bdec-c3ba6bebaaf2", "value": "3072:Y0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:zpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618422661, "uuid": "df8c9f8e-f41a-4c25-a1bc-801e7cb623f1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618422661, "uuid": "5488c1b4-a814-46f3-836e-2a185bd0af62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422661, "uuid": "51cdef23-9daa-4139-a89a-2cd1ef30a265", "value": "074964b86a1c924b270e603ea110753ea97d2d7146f524914f572d745ccd6eaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8287ce8d-9d24-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618406569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406569, "uuid": "82431b6c-2958-4bd3-93cd-92a9068fbaf9", "comment": "Malware payload (AgentTesla)", "value": "97d997d1cf6f3e3a6c74cf547f69a17e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406569, "uuid": "dde1da5a-70d9-4843-9063-cdeb52a78a07", "comment": "Malware payload (AgentTesla)", "value": "08432dd6e3aa5af68fa4ae67a9eb9e3bfaab70a46a12a8bb688ec0fe387b88fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406569, "uuid": "a2b05551-0acf-450c-90d1-b8bf6a2947bd", "comment": "Malware payload (AgentTesla)", "value": "eebc8cd6c4b428266560325f17f032fda1eaf2df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406569, "uuid": "2154186f-48db-40d1-8e17-ef641b113f3c", "comment": "Malware payload (AgentTesla)", "value": "4e6bc2363cec2f00c4fd72e52686892d9195eaf091d2d0a4e0661cb36a0c3213ef21c17b49ef26706897ac8bbea32029", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406569, "uuid": "699db2ea-a6a6-4a3e-84b6-48e5dced5b26", "value": "0A53E128D60A1968CFAAB67132B94342BBF8ED0775C5B20F1BD530641C827F5C3553AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406569, "uuid": "59ab9a41-6df0-4513-b4d5-886fe7e7bc5b", "value": "1536:G3W0nIcjELcm5h2IIUrw5biApXAaCM9+7AT:Gm0n9OgIetieXI74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618406569, "uuid": "7ea0da58-c911-424d-a15a-c7ddc027332b", "value": 61310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618406569, "uuid": "40dbf8c1-bf4e-41c8-8e9b-1a434b127121", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406569, "uuid": "6f7c28c5-f16c-4f33-9962-a5676d61a016", "value": "CHARTER PARTY DETAILS.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cf0e16-9d59-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618429424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429424, "uuid": "5c782e32-7608-49d8-9b6f-c8cb3e405b7a", "comment": "Malware payload", "value": "dcd99feb0aaabd23a67c972ba58c2fb8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429424, "uuid": "6eacccb2-36f0-4d86-8030-c616fc8f786a", "comment": "Malware payload", "value": "086973812f169270acab0ecfb5e6bd22053a39339cf96d3573e16b4f1c04dd0f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429424, "uuid": "a2dc1585-8934-4c80-a57d-4bcb2eceff55", "comment": "Malware payload", "value": "2a3b88e22b1e6ed594fe1b6526bffa4947a838dd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429424, "uuid": "cf6630be-91fc-4d0b-b366-cde7ee82d364", "comment": "Malware payload", "value": "49e8b92bdf2eca77fc8738f7c12d39b06f2d3b8767561cc02d9bd24536b10d4767a84c1f6af8545564fc72058d0902d6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429424, "uuid": "494c699a-d2e4-4d98-8cfb-399123f6fd0f", "value": "AFF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429424, "uuid": "9af5f8ad-7c50-4175-bc27-47ac88d1b0df", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429424, "uuid": "9f18ce95-f5ff-488a-a249-34a21ab84eae", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618429424, "uuid": "b7483f76-c135-4b8a-9dfb-3c4e5eede4ae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618429424, "uuid": "5e00c2c8-84c0-4beb-a13e-ac34f4f0846b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429424, "uuid": "87de3e74-e4e9-4bdc-ad42-7fa5e1d1f068", "value": "086973812f169270acab0ecfb5e6bd22053a39339cf96d3573e16b4f1c04dd0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567cf68c-9d59-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618429259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429259, "uuid": "47c74e7b-77ba-48c7-a5ae-41674ae89588", "comment": "Malware payload", "value": "37134cc99ee1faf919acaa7675316cd4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429259, "uuid": "57240a85-ccfa-446c-ac53-a4936098ceb1", "comment": "Malware payload", "value": "088d2f4b96a260912e8b0d668c2a86ded5a411f7bc71160623bf0b64a128cc82", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429259, "uuid": "b54258c1-b3ac-4f8e-b0fa-612ad7257165", "comment": "Malware payload", "value": "2475b301a5a6e85525fb21799eaaa747711685ca", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429259, "uuid": "3d241aa6-a3b3-440f-bc9b-2305907c428f", "comment": "Malware payload", "value": "1d942ba0809d94d97277964135a4c72d29140bcc7a83046c6fc755bd24c64fd2695661570d2f7d72f032a42860e593b6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429259, "uuid": "d33f378a-a419-4926-8d5a-de37d1afe33c", "value": "73249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429259, "uuid": "52c059f5-4b60-4334-9b22-a933f1ef170b", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429259, "uuid": "4d11e93c-5ef1-441e-81c4-a42549caee60", "value": "3072:N0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:QpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618429259, "uuid": "1aa86174-a8fe-4246-aa6a-8b6725464cee", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618429259, "uuid": "a3bbdebc-6994-47b9-bff9-007a416d4a0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429259, "uuid": "adfcfd5d-98c0-47ed-936d-8ba359efd218", "value": "088d2f4b96a260912e8b0d668c2a86ded5a411f7bc71160623bf0b64a128cc82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdac43d-9d42-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618419311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419311, "uuid": "915379d2-dbb2-42fc-b21d-7150cd9123c6", "comment": "Malware payload (AgentTesla)", "value": "300752264d46cfd0cabd1f34336d5dbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419311, "uuid": "2e0b5b66-deb5-41dd-bc60-aacd5283e9a2", "comment": "Malware payload (AgentTesla)", "value": "08946305fd95097bd28e16308d49a9798c68d5afd1403fd889bf32a12ad31842", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419311, "uuid": "7ad893f3-d36a-4fd1-b084-77f74b1247e1", "comment": "Malware payload (AgentTesla)", "value": "32d83ac28074f65db1aa0e0bea0fc06b5709150e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419311, "uuid": "801fd1da-408d-4cf2-a23d-fd2418afcda8", "comment": "Malware payload (AgentTesla)", "value": "0d03d07c6aaf77a7c96c4ecaf6c8cfcd9e499c8cbc5516d9cdc12234884a33a9a1b6b388128623997c903b20fd00e6ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419311, "uuid": "49e4348b-b797-4e38-9e17-f25924ada8a3", "value": "7BE4233BF29570318C670D6FED5C0CA63B2C5984A73DA943CB76C80E4E4A5A57F64CA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419311, "uuid": "8a08736e-90eb-453e-acc3-26d3363ab70c", "value": "12288:fJDi+rvufpfwTFQoij/jwo78MB3fKN9C4F0rPc15Tt2OTPnk9X9j/97RQS+h:fJ+wvuaCR5gs3f4APSTt2IPk9XR9e7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419311, "uuid": "2d764593-0a00-47a4-93fe-e26cd1d0796b", "value": 704480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419311, "uuid": "0fc855fe-c9fb-4b35-a22e-2ad609084680", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419311, "uuid": "2e98a9c1-2022-492f-83fb-55250f3138d7", "value": "2009025C##.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb0344e-9d5f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431798, "uuid": "9fb20128-43c9-4ac2-a6d9-a518b7b85f5b", "comment": "Malware payload", "value": "7da3d901f4da32109130bcd3eb467ced", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431798, "uuid": "b416195d-a5fd-4f36-94fe-3c52dcb6d858", "comment": "Malware payload", "value": "09760329a2d531d3933d7eb92e95a3e20dafe50e520085898159f306278944d3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431798, "uuid": "bc1fd1be-b7d8-4ee0-876b-7aed2c41ee9a", "comment": "Malware payload", "value": "c154019370cdb486fcfc17edc1406ead2eed28dc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431798, "uuid": "ca0fcd69-dbff-4c90-b6f9-514a31c51083", "comment": "Malware payload", "value": "ac4f286c5263a7ff833dd0094571a3fea799fa6628a7792ac38ced3d75773857cfb1f3e3598b3d170e2060d43a312f01", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431798, "uuid": "104df0ad-ebb5-4ddc-a2d6-35377c3bfb19", "value": "82249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431798, "uuid": "9b9c40c3-4417-4828-8e10-f534affda8f1", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431798, "uuid": "e3004064-31ab-425c-af82-f6da12b0bf54", "value": "3072:f0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:+pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431798, "uuid": "68baafff-55dd-479b-8edd-8fef5b802814", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431798, "uuid": "6552a537-389e-4c07-8582-b00e4d42c816", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431798, "uuid": "50a06ea0-1ed2-4a98-b1ea-025c107199db", "value": "09760329a2d531d3933d7eb92e95a3e20dafe50e520085898159f306278944d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f32dc0-9d55-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618427547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427547, "uuid": "edbeb870-4667-4cf8-a158-4ca8e9b6ae00", "comment": "Malware payload", "value": "3a6a72e4c27dcad40035800ef5b27151", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427547, "uuid": "fd888267-513c-4d08-b2c7-b5ca55613ea6", "comment": "Malware payload", "value": "0a141ac652c6d6759f528367aa0885bfd89767bdd0d74ddb48c9b94cb8e9aea2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427547, "uuid": "3e9ec70c-b6a0-4c50-846a-299ad0075618", "comment": "Malware payload", "value": "6634b9a0c18c4c210f7b61d8d2548cd00345a084", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427547, "uuid": "5120499a-e469-4166-83ae-48b1dc832793", "comment": "Malware payload", "value": "b2627bfa3f0f7e0a2e53364f29fc4ddcf6d4ff30071f2ca7c2ed873b66824b7af1952fd6b8c7b860d2e9ea5e06e827a0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427547, "uuid": "a8e7e2dd-23a2-449c-809f-11ddaa125866", "value": "66249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427547, "uuid": "aab5df0e-1d75-4195-87c3-6ba9e188cacb", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427547, "uuid": "7898ce19-3877-4a77-8893-a079df046b0f", "value": "3072:70DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:apepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618427547, "uuid": "5fecd148-4d4f-4395-9849-16555634003a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618427547, "uuid": "9fdc1030-5a84-4f35-a823-50cf824f7d5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427547, "uuid": "ef8b29b5-4527-40e6-842a-e61eb1662111", "value": "0a141ac652c6d6759f528367aa0885bfd89767bdd0d74ddb48c9b94cb8e9aea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2247248f-9d53-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426594, "uuid": "6442c260-700c-4653-8b18-b851de59c291", "comment": "Malware payload", "value": "1b767c1e02855094a7a1e5afe2b3c9c0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426594, "uuid": "205dcfcc-cdd6-4d64-bdca-71f30d604b09", "comment": "Malware payload", "value": "0a5046b7a3ba2637ff68d48fa193b03959fdffbd38ed8d3ce3d264ff03774890", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426594, "uuid": "9038c778-053f-41ca-8d05-5c60fc83162f", "comment": "Malware payload", "value": "7120db57c9068111ce5444e30a23314e705f5c06", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426594, "uuid": "4be8e447-d6c8-4533-b351-0a051779e764", "comment": "Malware payload", "value": "c11a63ce2393de576b87fb97063c72187762c6e2aca9cf740a3c3eddfa6ed71abaed13a8d0b7a996282e757addd42976", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426594, "uuid": "1b0c74f1-5add-49ab-9a32-6ce80cdadcab", "value": "49F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426594, "uuid": "e6a84dbd-b49e-48e3-9d76-2dacf498bec6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426594, "uuid": "2c05d73f-323a-4def-a9ce-ed241aaa7ab2", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426594, "uuid": "0743893b-a386-431f-ac17-1b47207e959d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426594, "uuid": "ccc9bd99-ae03-4061-80b2-bd2ac1f968f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426594, "uuid": "c70f0dd1-2ada-478a-9c2f-7b5a5133273c", "value": "0a5046b7a3ba2637ff68d48fa193b03959fdffbd38ed8d3ce3d264ff03774890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36652d2e-9d4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618423622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423622, "uuid": "dd827685-2a40-42ab-be02-dcba911d9f08", "comment": "Malware payload (AgentTesla)", "value": "f59b0f9d9b8a789b7e3d4ab8e0ccf737", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423622, "uuid": "2f224b51-cbd6-4836-b801-ad0e8fac33a1", "comment": "Malware payload (AgentTesla)", "value": "0a873d72d161d2ed545a8ca6534443ed9d15f377a135b1e8d8eed14a0d2ff68b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423622, "uuid": "54013307-7f95-4d97-b419-f6e312bd4713", "comment": "Malware payload (AgentTesla)", "value": "e4835a1a2ec55cbb7e7665ce6edc0fdbbfb90f5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423622, "uuid": "8b4002cc-55d0-491e-ab8d-5bd7d3fb53e9", "comment": "Malware payload (AgentTesla)", "value": "eace07c296e5dae3adce9b2af6ef2649d7d0865ddc8aaf6d95056660a9743f214451135db02e71b04888970142359ca2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423622, "uuid": "5156fc9b-b983-4ebc-958e-9af0b735ad43", "value": "F7257C0D27856E34D6EA8F328896A0108FF8D40F2E59D6572EF8DCD9347BF21456DA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423622, "uuid": "87f40ff5-aee4-46a6-832e-31971ee406f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423622, "uuid": "6ecbaae6-408c-48fe-88e6-75c3d570e41a", "value": "12288:fx50rNmwOKgwCviDn+j/M2hXtbvAb7Ux5V+vO8ZSBRkFsmFrTNnMKOfmsM7:+Nb6dLjZ5tbv44B7RazPnzF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618423622, "uuid": "8dbc13ad-d719-4a7e-8526-876a2818416a", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618423622, "uuid": "fe65e98e-6bdb-4475-92df-6770ab9732a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423622, "uuid": "e17adf33-49f2-472d-92af-e43e15743ad0", "value": "ORDER 5211009876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da563e13-9ce5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618379658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379658, "uuid": "c8b62a7d-c791-44c6-b147-4c51771eb9d9", "comment": "Malware payload (AgentTesla)", "value": "a1d14b8b904fe23d2630dc23b19f7b66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379658, "uuid": "ce2dcf0a-1e91-400f-9295-8f8532f89c38", "comment": "Malware payload (AgentTesla)", "value": "0ada5745e3018d1d35dd2de42082a97c151a0285d459f862bcae5387e57eee10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379658, "uuid": "1dde426e-0c62-4c93-9ed6-086ee76fed8c", "comment": "Malware payload (AgentTesla)", "value": "8a03039da680acfe8fab1370308a9d6ca9f20422", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379658, "uuid": "c331b04e-a3f8-478b-a672-e2fcafcd13af", "comment": "Malware payload (AgentTesla)", "value": "c2d964f50ce13ba378df3da51edbd612748e0e906ef95857d97a36e0e02e0739352f55e21efeef784966aab26082e5e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379658, "uuid": "3c300e3b-014d-48ed-9e74-45662fbe080a", "value": "38D423312504D3AB933B6689E50F56AC8CE57E52F958D44D0320B3B5F2887B8D3BA46F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379658, "uuid": "6d65c0f8-12b3-45c8-bf94-ceac6c9f93af", "value": "12288:baklYQOLwt/O2UXbtGJtNnbVCFqAiXRajudRTJYr2uSnrn0fK:rlYVwlOJXbtwBbVCgX0exnr0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379658, "uuid": "732f5333-2dcc-4db9-b967-cf1938949e96", "value": 652190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379658, "uuid": "d8879ad1-bb6a-4e51-af5d-cd16c4ee3ad9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379658, "uuid": "d0048196-b3a5-4ed7-8fe0-9594f405a13c", "value": "PO,Order#4500484210.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4a03bc-9d49-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618422474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422474, "uuid": "8d0bca5c-55bf-4db1-810d-74a7375f7fe9", "comment": "Malware payload", "value": "53d27444c748007c73b86dbc46ea282e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422474, "uuid": "2a4954c6-97cc-4dfb-a64b-d2fe77222a0f", "comment": "Malware payload", "value": "0b237cb860f91b3f4f98c6b6b4766183280d665cabfbd2e18a7c08332f109108", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422474, "uuid": "17e21a65-bb43-463e-a830-b7dad230d4cb", "comment": "Malware payload", "value": "6a15ce9b4092682eaf82e7e483bd94d08b0a5060", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422474, "uuid": "73d27ad2-aa6d-465f-bc16-af7012dc02fd", "comment": "Malware payload", "value": "5212914bc12fda2b83bf423f5f6eb51bcff06d6a494eeb736cc8a17237255e3249bd5075a5ab14cb2c37a8bfd4b58f16", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422474, "uuid": "737a411a-ec98-4bdb-b0a7-e012ad9be26d", "value": "C8249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422474, "uuid": "7f7d859d-d4ce-4a2a-95a9-c6643ebf7403", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422474, "uuid": "9ae2709d-09ca-4a82-8182-0ce9af1a6ba3", "value": "3072:50DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:MpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618422474, "uuid": "5df8b43d-5b4c-4086-b466-79f084d91b58", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618422474, "uuid": "3c7e41d4-191e-4a7b-9c30-af62fb2d1a94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422474, "uuid": "96789136-93ba-4636-91b9-6311ab254724", "value": "0b237cb860f91b3f4f98c6b6b4766183280d665cabfbd2e18a7c08332f109108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19814eed-9d3a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618415842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415842, "uuid": "76331b45-56d3-4c63-a7d6-e69e29b126ea", "comment": "Malware payload", "value": "514b2d2e5d32325e587c4c42d12f04a7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415842, "uuid": "9ec4e3d4-68bc-4d1a-93a1-e4471e8dc81a", "comment": "Malware payload", "value": "0be0a47407003a6e7597abb70413ae735cc5e960b40d8a974fe9a70911af4ae0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415842, "uuid": "8bf86314-deae-441a-bbdb-ae7adce4c355", "comment": "Malware payload", "value": "9cf56159ac93d1ea37e5179ec570a15ec7a07252", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415842, "uuid": "30cc0bb8-2062-4272-ba21-761c636d0ea8", "comment": "Malware payload", "value": "9e28e9cd031588fd1c6733c07a3370d6356e0457ed8fb00c0e8fc833b99f196299e2afcaa8814e2f48e0e8bc8d0820dd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415842, "uuid": "5a525bcc-a890-488b-8ce9-ce2d2900628f", "value": "99249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415842, "uuid": "9f2dbedb-8e84-4dfa-9c46-4fcb465ddce1", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415842, "uuid": "143e76c6-e39b-4d5a-8e6b-9e3d540ff0c8", "value": "3072:S0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:RpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618415842, "uuid": "dd771821-3028-477b-a650-0ec6b5618221", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618415842, "uuid": "1ccffbe1-036b-4d08-8506-59781965517a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415842, "uuid": "2c4a6be2-05d7-407d-85d2-db4726d01333", "value": "0be0a47407003a6e7597abb70413ae735cc5e960b40d8a974fe9a70911af4ae0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c796599-9ce6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618379850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379850, "uuid": "59261df8-f30f-4cf6-9f87-b518dbbe1f94", "comment": "Malware payload (Formbook)", "value": "29e28ecd36c63c4e19a8070f46105486", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379850, "uuid": "b010f726-ec6c-41a8-befe-ee472e554882", "comment": "Malware payload (Formbook)", "value": "0d08b54442ca31c8e6efd08954f3e1ad3a0246ce4d4dcff6a41e3e87e25b1029", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379850, "uuid": "c62d3d97-0bed-47cd-865b-44d776940163", "comment": "Malware payload (Formbook)", "value": "25ed2290f2567d8abf5bdb171564f3442304abc4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379850, "uuid": "d2a8384f-9c46-433f-9d73-10cda7dee22c", "comment": "Malware payload (Formbook)", "value": "fabdc0d709dc3d1a253d2de0145970803d5a5f3102a51312b073bba88053dea9b49a675f40f0e734d9f39f7478dba9a9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379850, "uuid": "b991e4c6-d38e-46d1-82eb-5644f6c5ffff", "value": "90259E1217E56E0AE37E8F7398229030DBE5EF073D56DA871DC43DCA34B9B209916E19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379850, "uuid": "d2117a2b-f993-4805-922a-53626dc186ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379850, "uuid": "4823252e-a018-42eb-bf8f-37f0bb4bbf4c", "value": "12288:OGv4GTGd9nxe2LEjUr+0kX9FVC8kbSHNlcvU3QgJpebKB9sk2:YGTGDxelUrzkXoV0k8ggmeB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379850, "uuid": "e1055c51-8eda-4e91-aed9-97a4f6c7bd72", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379850, "uuid": "78b74442-2b31-4956-a2ca-2e12237f2556", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379850, "uuid": "6cdfb709-46e2-441c-81b8-4b7844737da6", "value": "RFQ-14042021 Guangzhou Haotian Equipment Technology Co., Ltd,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecdf2bf-9d2e-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618410992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618410992, "uuid": "d41b7135-262f-4574-88a3-486a6131d52f", "comment": "Malware payload (RemcosRAT)", "value": "366d029855541c19d5951ac825e04a33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618410992, "uuid": "70804cfc-9009-475b-b63b-f99096040810", "comment": "Malware payload (RemcosRAT)", "value": "0d0f9ca99e1de30499a97020eb01a4cda5744eadff4faf56a79f8080c515002c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618410992, "uuid": "d8059fcd-661b-4d9c-8450-02c3f94c64b4", "comment": "Malware payload (RemcosRAT)", "value": "43cc316caf1cd9d3f53e0a81ef6baf0b58b8ec1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618410992, "uuid": "a4efaa92-aaed-49b4-8c4f-8457e8a67eda", "comment": "Malware payload (RemcosRAT)", "value": "4db51f6d8242d6793ecd477e6eef7084a75b588e623279c2b384435e212d77340a18460f9e98ba090b94177043e33c75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618410992, "uuid": "f2c5fe58-60ff-47fe-b91c-b5ab0de48309", "value": "5C35BE1313E5AF46D33E8F739422A500CBF6D7573E17EB972DC900C916BAB219A11E1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618410992, "uuid": "4dc402b9-3534-4df5-b1e9-0c6a58844435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618410992, "uuid": "450b7a8a-8aa1-4f02-820c-118a56134993", "value": "24576:xln48EDLmg51bTtLykpCUBjoEMMfGLHItwNpop97:Dn48EDLmg51bTt3pCUZoEMMfTwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618410992, "uuid": "34410067-a7c6-4c2e-87ff-ac8b4818f855", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618410992, "uuid": "ce1d5bd8-f0e5-4abb-93bd-62e556401c75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618410992, "uuid": "8c06130f-2170-4610-b228-5627e15d3f53", "value": "a7cQje0wGxiZkwL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0772e8cd-9d41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418818, "uuid": "b68b761c-511b-44f3-ad80-1f05d20cccec", "comment": "Malware payload", "value": "cbefb7c08e04218ce8ed7f5fbf139f0e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418818, "uuid": "d64d51fb-1bf9-48a1-9cb5-025a15a240ba", "comment": "Malware payload", "value": "0db866fd14a24867b2d4042a656d2929367fb82b98ab3e3dff21832f0da2ba82", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418818, "uuid": "f21b26f5-af46-4790-9b92-2ebad3695d60", "comment": "Malware payload", "value": "6bf4bac5eee0844b11526b8f4ebfa1455a46e495", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418818, "uuid": "a24f61db-0efa-4ee5-afc7-b2d8443c3ace", "comment": "Malware payload", "value": "e10e1a6bed46dd89c6c6094f20a006e8ba921c25348d0a0c735c09b55eff1dc0daa7fdbcdb3436edec19449658401789", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418818, "uuid": "a6804f03-55f0-481f-a3b3-4a49f4ed1073", "value": "DD249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418818, "uuid": "bf597c2c-736a-41d8-8fd4-549b9772d2e0", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418818, "uuid": "f0ec595b-dce2-4268-9a2b-53c2935f8d61", "value": "3072:x0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:kpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418818, "uuid": "8d9e0e36-66dc-445d-87f0-71f2fbf95d37", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418818, "uuid": "4d230ecb-cd9d-42eb-aaa6-d6fdde01f08f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418818, "uuid": "2125840f-54ac-4efd-9c45-18dae59fd6a5", "value": "0db866fd14a24867b2d4042a656d2929367fb82b98ab3e3dff21832f0da2ba82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fa3f9b-9d56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618428127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428127, "uuid": "7eae883e-2740-4624-b677-ba7dc37b49d8", "comment": "Malware payload", "value": "d0d5d4b65893d91584eaaed4508570a3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428127, "uuid": "cb71041d-5594-44b2-8560-14a8dd7f0043", "comment": "Malware payload", "value": "0ded78f935c99b7e87d33651081b3ce376d7c1fa9d4ee311488099572675c6e8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428127, "uuid": "d7892d53-0a95-4e9a-a2d6-01daf02a95b1", "comment": "Malware payload", "value": "a99ce3cfe0ad5028ddadc898b2295285cade37e2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428127, "uuid": "87403349-659b-41c4-8313-f3a7428f3890", "comment": "Malware payload", "value": "d5b97319ff9e95771244a0cc4cf6e9c7328681b2e92c7018bdd51c63fdbeddf9c970c50998577b4afd95f0a311aa5013", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428127, "uuid": "f419e97f-dbe1-432c-9617-fb83c46d3b5e", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428127, "uuid": "94998e3e-f2d1-49a4-9073-1a604c819036", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428127, "uuid": "761132a1-eff5-4005-bf52-9e0cf86056d8", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618428127, "uuid": "6150cd3b-9266-43d5-b578-4a21f52d19bb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618428127, "uuid": "1a1545a3-1638-4004-8496-31a8275f0fff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428127, "uuid": "f5310160-c23e-4c33-a548-e0d47771614c", "value": "0ded78f935c99b7e87d33651081b3ce376d7c1fa9d4ee311488099572675c6e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665890aa-9d3d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618417260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417260, "uuid": "baed1c61-7405-4fb4-944b-d78ac9daa843", "comment": "Malware payload", "value": "5bae4a7d4190ee59f4bfa857c053beed", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417260, "uuid": "4bf474e5-8476-40bd-a714-9dab6e095c02", "comment": "Malware payload", "value": "0dee0733c74041b495dfd2fa5a258ddd94c3ea12748d52edd6a53cc6f8e11d8d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417260, "uuid": "11789428-ae15-4863-937b-c2555ffe215d", "comment": "Malware payload", "value": "ec3f2010c42b18d0c18518e076982312a019bc61", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417260, "uuid": "742461a3-ae41-403f-ba5f-255600d58063", "comment": "Malware payload", "value": "45655bd8d91302a9977ec3aaba6b958ca72ec821aa9421bc9092ebf410b9c10d574619f4fb6824629585146ce20af6ea", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417260, "uuid": "e96d1205-6331-4713-96c1-8ede161d0034", "value": "BDF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417260, "uuid": "7e2e5234-f847-4135-9782-c119a9159c44", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417260, "uuid": "30b66447-6df5-4173-ba39-95a1ef203fa2", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618417260, "uuid": "2bb01356-ea8d-4233-b60d-563471235159", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618417260, "uuid": "79486f60-3406-49ea-a9f0-b8eb743319ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417260, "uuid": "55d59336-346f-4619-8b9e-013acca978e7", "value": "0dee0733c74041b495dfd2fa5a258ddd94c3ea12748d52edd6a53cc6f8e11d8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32405f3-9d47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618421710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421710, "uuid": "682c9b57-0bee-40eb-90ab-d13139d7903c", "comment": "Malware payload", "value": "fc080d72c1f4dc170ca46164dc568c3d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421710, "uuid": "b77fb6bd-b070-42a8-8b1b-74aa26b71fa7", "comment": "Malware payload", "value": "0f3fe1bc44d3c26012970f4a106c13d0b0dd6cc4abcfd48ccbf683e0dff90c71", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421710, "uuid": "2465ba47-8f4b-4ae0-ba05-f417f1c12f6b", "comment": "Malware payload", "value": "871112775d44fa0fb7713220bad786cabc6286b8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421710, "uuid": "28b91fca-ef27-46b5-a078-d00d3e04055f", "comment": "Malware payload", "value": "30360a3dba4b533542e68c47b7672011dd7334ae8d4347910482a4c2dfa3f03edf4e05dc5021569c54bf331ea157a2ab", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421710, "uuid": "1feb17d9-377c-4d5a-a4b9-c560a843bea2", "value": "46F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421710, "uuid": "76693f3c-3773-4954-9641-b64c1c9e6d4f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421710, "uuid": "916a4819-45ac-4a7b-b19b-3058b77a2ee8", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421710, "uuid": "d74b6910-d46b-43f0-a196-edbc2d6a7697", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421710, "uuid": "dd7cf233-cae5-4934-96e5-f36323e8e0c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421710, "uuid": "53186fb6-172f-42e7-950c-d0895273310c", "value": "0f3fe1bc44d3c26012970f4a106c13d0b0dd6cc4abcfd48ccbf683e0dff90c71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283a82f2-9d62-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618433047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433047, "uuid": "edc68da0-3507-47bf-ac06-226796cbaacd", "comment": "Malware payload", "value": "ce0da986e54d5d1d64702d44bacc8de7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433047, "uuid": "08666c21-7645-4695-9f78-951eff787a48", "comment": "Malware payload", "value": "0f7ca452ce987f245d51282a2bcfc27a5561b813c611b251c1de234bb9cb5745", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433047, "uuid": "ab70ac5c-a340-4d78-8fd4-b4c85eb5004b", "comment": "Malware payload", "value": "45c8dfb11f9827c79fbcbab7f50af3dd0a04a820", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433047, "uuid": "be4fd11a-8162-4873-beb3-af13bd7cfa1e", "comment": "Malware payload", "value": "e09ed1d295a43cceb6be9bd66570b1e12f39c588e2bfd734b9592ff85ba51e44e29307dec0941fb84026ed23faa1504f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433047, "uuid": "d962d71f-3775-4b3c-99db-1d28a2fb8358", "value": "67F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433047, "uuid": "4aaf7666-9f8b-4fae-8747-2297c0331d13", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433047, "uuid": "ee3a0b35-1e79-4903-b6a8-60b7c2181d7c", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618433047, "uuid": "07e6e967-2523-4cd1-b3a1-42aebc6114f3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618433047, "uuid": "975040e5-c97c-4fa6-af74-e51dbeb3acb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433047, "uuid": "32fe8ca0-df64-45fe-a39b-3441a2fa8081", "value": "0f7ca452ce987f245d51282a2bcfc27a5561b813c611b251c1de234bb9cb5745", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386ddbfb-9d53-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426631, "uuid": "ff5f8722-5f97-4349-8dce-5d3b9643f3b0", "comment": "Malware payload", "value": "a4172d5a5c01301204a0bc50fd3a84d3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426631, "uuid": "615aabe6-2a66-41bf-961a-b53994676adf", "comment": "Malware payload", "value": "0ff73943ff3226ecd17a37749b07a11fa735503a8c54be67eb5afbe27e3d6cc0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426631, "uuid": "d9bd2d10-ae20-429e-adce-52bd12b84d84", "comment": "Malware payload", "value": "58738477da081ccbe168f686143f7f96eb319d14", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426631, "uuid": "467d29eb-110f-4c7c-a7cc-738d7e7b024c", "comment": "Malware payload", "value": "649754ba14efd36de8d063110d32815dba5b57fd6707af9f6c151ab515ddc83bc85b13c9facd90d7228d273b5473ec08", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426631, "uuid": "d20ac1bd-3c1b-4972-921b-0548848db6fa", "value": "65249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426631, "uuid": "f67098c4-f444-4622-9558-e7abdccfd213", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426631, "uuid": "ae45f464-1740-4254-b08d-7174a35f20e8", "value": "3072:q0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ppepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426631, "uuid": "3497c6fa-b9f5-4a2b-abbe-05f7784ef30a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426631, "uuid": "6aad1d6b-bab4-45b0-a3ae-93f3d957d5d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426631, "uuid": "2e29bc60-119f-45dc-be03-fd52ed1fc953", "value": "0ff73943ff3226ecd17a37749b07a11fa735503a8c54be67eb5afbe27e3d6cc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d1c850-9d6a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618436806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436806, "uuid": "6756f259-ecfd-4922-996a-ef20ad2a022f", "comment": "Malware payload", "value": "2d456c80ab64a727c6927fc9ab7c4dd0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436806, "uuid": "5ddd8218-7f3b-4052-8897-fa81abc3422e", "comment": "Malware payload", "value": "1004d15a7ae4650618ff3da0cb30a15f04c01cbd1e7862feefe0a9211b4104eb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436806, "uuid": "7dcba0a6-5eec-48af-818e-1aa2f918a130", "comment": "Malware payload", "value": "c66b08932b959114b816878b97392c49c24bdcb7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436806, "uuid": "ecb047ad-4306-4e87-a9ff-8faf2b3a2478", "comment": "Malware payload", "value": "50b7492e0b5445089954cb72b384d5610a81a83d9651113bb6bfdbfb31084b80c39704bc5ca8b8190aace45df1e72925", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436806, "uuid": "19e5b77f-f1c8-4f10-bdb3-46fe62e3f3be", "value": "BCF3C088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436806, "uuid": "d5fd7741-438d-4635-986e-b1a80e87832f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436806, "uuid": "a480b4d5-0eec-4614-a6d8-66df2fcb64d7", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618436806, "uuid": "3b384bce-4437-4504-a679-27c457865d48", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618436806, "uuid": "530c2e75-161a-414d-a29f-c568898f0536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436806, "uuid": "931999fb-6333-43ba-8069-29427160d3c2", "value": "1004d15a7ae4650618ff3da0cb30a15f04c01cbd1e7862feefe0a9211b4104eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d10991c-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424921, "uuid": "2255abc5-6ded-44c7-830d-843764978f61", "comment": "Malware payload", "value": "d6cf7ce53f7f3018b6335b453d4188e7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424921, "uuid": "698ea194-6aec-4719-a9b4-12b108b63898", "comment": "Malware payload", "value": "11f8749ed3bbc7bcdd2a37b7769ace43c948e5f98b5d3f800365eccc54e43541", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424921, "uuid": "f7b23cf5-22f1-4579-beec-6198c6e44510", "comment": "Malware payload", "value": "1db8778011cebf5bfdeee986a9a8195920cef957", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424921, "uuid": "806b731f-8dd3-42b1-a798-13461d53de1c", "comment": "Malware payload", "value": "4c7a2b6a294c438c4e3cb03687410692ec781607725e343cf05d62dfae365009adf0d45329ddd725eab92fb9540f540c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424921, "uuid": "06f510fd-8a17-4fb0-a9cd-e752f1290b8f", "value": "1CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424921, "uuid": "b8b29a10-72cf-4368-9cb3-d0c12ce924d1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424921, "uuid": "176831e1-c807-49ab-9ed4-467557d71989", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424921, "uuid": "abee36ef-d155-40ba-bccd-127cd0b08a80", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424921, "uuid": "76219860-724b-4b75-842d-1ecec985a7d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424921, "uuid": "32e52985-52ea-4961-aa1c-baeb4dbc1a99", "value": "11f8749ed3bbc7bcdd2a37b7769ace43c948e5f98b5d3f800365eccc54e43541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109cb6de-9d57-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618428283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428283, "uuid": "2f7681bd-7b8d-4e7b-952a-56561c4b99ff", "comment": "Malware payload", "value": "07509c562a1a799ffcfd3521a02ed451", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428283, "uuid": "0c2a9442-e9ed-424a-b8e4-a4afcd9249e3", "comment": "Malware payload", "value": "1234236e8762d33e46d4ac9144a777dcb490f82f8c8136868b382768f84dff36", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428283, "uuid": "210197ca-99f6-4b55-bca2-7931974160b8", "comment": "Malware payload", "value": "ca68e8dd12d9f3d7074f853be9fc743e737ea440", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428283, "uuid": "147a34b0-b24d-4bb3-a95f-5d8e609ee6b6", "comment": "Malware payload", "value": "c8da2856fe3ef178cbfef194267c07993efa2e47df90d58e2a077531b2d1285f1a5f43d14b089dd4cb5fd423e85f0781", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428283, "uuid": "6737d9aa-08fa-463a-abf0-415f245d3308", "value": "43249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428283, "uuid": "0fb2236d-5ed0-40e7-803e-e6bd89f3c097", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428283, "uuid": "7f376b73-d4d5-454e-a7ae-369c8a5de969", "value": "3072:c0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:npepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618428283, "uuid": "39bc76d2-91b0-4f9b-9a35-2c7d170f43ef", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618428283, "uuid": "c0defe1c-adb7-47cb-bfa8-2e3949d3345a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428283, "uuid": "3f8539e1-a992-4a23-b51a-710db147ded6", "value": "1234236e8762d33e46d4ac9144a777dcb490f82f8c8136868b382768f84dff36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bac66e-9d56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618428100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428100, "uuid": "fb43d396-18a9-42fa-ac0d-c36df3c00fb2", "comment": "Malware payload", "value": "2f2e3ea279885e111139f96c316ee002", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428100, "uuid": "287c7138-c3f6-4317-a7b0-a433ee24d9e2", "comment": "Malware payload", "value": "1293025b93fedc5ae16d9917ebb95dd4430689d9c62eadc3f8b928484ef727c0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428100, "uuid": "56ad8381-7d17-46a0-b827-93210aacafc8", "comment": "Malware payload", "value": "8c2423caef6ad893c6c0ef9148a9bfbdd61dd15d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428100, "uuid": "f0931662-38f4-40d9-848e-da1d3f219705", "comment": "Malware payload", "value": "6a772efa9b128fdb6e4c971bc4bd05861bf53a9bffaa1817ad8665ee9a6b59fc7ce3ef1b5921394e8e74ae863718c384", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428100, "uuid": "9db91069-65ec-431f-8e3e-4da6067fc9ec", "value": "B6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428100, "uuid": "aa90ca80-454d-4cd4-89d8-fb8d381951d9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428100, "uuid": "4854dedf-4205-46d9-b805-0b38d441cdc5", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618428100, "uuid": "ae987032-8bf4-4cf1-a7e1-6829b93903e3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618428100, "uuid": "db461d5f-62c8-46b0-8e02-270ed54aecaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428100, "uuid": "c237aa4a-a564-42e6-8939-7f77f25b333e", "value": "1293025b93fedc5ae16d9917ebb95dd4430689d9c62eadc3f8b928484ef727c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a833176-9cbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618363177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618363177, "uuid": "1d50cac9-0f16-4321-ad2c-7b1f707a2b8f", "comment": "Malware payload (Formbook)", "value": "06340e1581d3a9f4bf144a5deb59a43f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618363177, "uuid": "a8968eae-afe8-44d6-9fdd-ada9f910aa1b", "comment": "Malware payload (Formbook)", "value": "1317c23f8eea002d8416f645c29ed93b565a301bfe5f6a4008dff710e560141a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618363177, "uuid": "74bd76a7-67d0-4c68-97c4-1ecb566fc74f", "comment": "Malware payload (Formbook)", "value": "087f1c5470caa341de959b6a565a27434b560497", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618363177, "uuid": "14ab9d08-cd92-45bc-9756-52989533a1aa", "comment": "Malware payload (Formbook)", "value": "b994ae5b49cb4a5cb1af5b775954820ea4486a775fa5794ee6ca3c9aabd513905f225e7a98b89a86bc48f125f295a63f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618363177, "uuid": "456edaed-0284-45f7-9bdd-a442bd21def8", "value": "F1D5125BAD82C9A9E464C732EAD954F463BB2D5DCC4A44DB7610FEC43B3A0C1C289366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618363177, "uuid": "be8d2ae2-74b4-4141-b2df-ce587353496b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618363177, "uuid": "6c6347c0-db28-4026-9940-67f235b8a4e8", "value": "49152:V4ZFB3t1eXUYQe/cn/tnVF0KY7Yh1J1qN5U5tYAjTpS2ekhFFJUlrjUYtI+6ozD2:Gd3t1eETV/0KY7Y7Sy7jTE2PJCjUYi+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618363177, "uuid": "e107a737-d1f1-4ebf-965b-8ab6802ce245", "value": 2771078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618363177, "uuid": "eb86d188-6075-40b0-872a-1478f3d21c0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618363177, "uuid": "db47d20d-1b73-471b-ac6f-c92815bdfbc9", "value": "INVOICE PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91648a4-9cff-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618390823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390823, "uuid": "cd948f0e-17bf-439f-a6f6-2b48b2982558", "comment": "Malware payload (SnakeKeylogger)", "value": "c1a4b5d17e9be0a9d3c7fdc01ae964b8", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390823, "uuid": "3d94ab99-4c72-4bb0-a106-d3586621ba61", "comment": "Malware payload (SnakeKeylogger)", "value": "142a5e8ece08612353c4358b5d43c2dbc8aa50c2b0c0526bb75a2230db212e00", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390823, "uuid": "f699ff7a-da8a-4f26-8016-46621678ad71", "comment": "Malware payload (SnakeKeylogger)", "value": "db9308eea1a71ed93b6f226d96592b35eb81666f", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390823, "uuid": "3458631b-dc45-436d-a458-ec876f61c42a", "comment": "Malware payload (SnakeKeylogger)", "value": "7d90cb023051445a0e12c37f1e9faddf2bcc4bb5087914dce57f3f9fd99171e0bb27a926d3242b5b4766579449fa6ae8", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390823, "uuid": "c9682c12-6897-43e8-b91f-54ecaadd8ab2", "value": "3915E12123E98B15F27E7B789571122007F2FC56DB35E25C3E9A20DE0BB5F618962363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390823, "uuid": "e3527bed-d1d9-4361-ab34-9632e9f16c33", "value": "24576:xzzRs86IpLz7YOSFWQVMJbCmXTKjVpsZmU2:1CIp/YOrGvkyV+UU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618390823, "uuid": "e2cc5df4-6ec8-4bfa-bad5-e85a0bf3f1e7", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618390823, "uuid": "b29a2588-a522-4d51-b025-57050cdcc207", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390823, "uuid": "3a3e4ecd-4141-4fd5-bc82-001b0c52a7cf", "value": "Neue Bestellung_WJO-001, pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22187310-9d67-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435184, "uuid": "4193c6e3-47c5-4725-8f70-8b8a58becc95", "comment": "Malware payload", "value": "65abb6e55682a252870b9fc33114acd0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435184, "uuid": "151e6072-a0af-4bf1-a8c1-0b97acee54e8", "comment": "Malware payload", "value": "156f550bd90e28a7ae3d36fce9386db2ac51169bf28cd4b9d4a91592708884ac", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435184, "uuid": "4260d8fa-a4cf-4d53-86ef-add5ed2e129e", "comment": "Malware payload", "value": "d22e27bbc3a7c72d4faca5af3ed97a7ea94cd4ef", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435184, "uuid": "09b1a15e-6166-4292-a23c-730ef0076faf", "comment": "Malware payload", "value": "08e9cf0e9d66eb39abcb011dc81a4cf911f2e154a0ea564d52e39c28ab0fcf927fda45bed53527f7153e42af5423c677", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435184, "uuid": "c6273fd1-9e4e-4c35-85e4-586e9c55aee7", "value": "79249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435184, "uuid": "9435fcb5-5bbc-4f16-94eb-1780e0a827c4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435184, "uuid": "1fb44de2-9282-4586-a3b8-11fc3c662f6f", "value": "3072:Q0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:rpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435184, "uuid": "3a5c7669-a433-4152-a2e7-fac13ead3109", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435184, "uuid": "d3de475f-3919-4c4c-a47e-7899da5dd9d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435184, "uuid": "4691624d-96c2-4356-9292-904393f5e70e", "value": "156f550bd90e28a7ae3d36fce9386db2ac51169bf28cd4b9d4a91592708884ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e2e7d0-9cd3-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1618371709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618371709, "uuid": "17ba2107-296f-4a7c-a30f-50b88023b752", "comment": "Malware payload (NetWire)", "value": "a436ce1c3efc46523deaf12e1c0a57d0", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618371709, "uuid": "aebda75a-07ad-4d3f-a308-8efef16aaf92", "comment": "Malware payload (NetWire)", "value": "16fc50c5d5b5419d2a3244294c7d6a77087edca488ec63146b573b31f1526809", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618371709, "uuid": "26696419-0e24-430a-abf7-6fe33ff1a50b", "comment": "Malware payload (NetWire)", "value": "117a14835cb828792078ad6cfad26bea452f9ccb", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618371709, "uuid": "648fb8e4-77cd-4e2c-9cae-7fe71312587d", "comment": "Malware payload (NetWire)", "value": "393924a467fc5c639f98768b98dc5e91a12c65a93f0b5a543965ad0531efea52bb41c194fc77b44df89fded028a9a3c6", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618371709, "uuid": "e809ddbb-bb9e-44eb-92d9-485a40b3a066", "value": "36056C21B351D8B2D02E19788D0B46F858A9BE30F9345C4B76F4BD0C3EBE6607D5CA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618371709, "uuid": "26c68a16-a409-4dd5-a7e6-aaeeee8652db", "value": "5460111dfb820e05d52b9be905fc0229", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618371709, "uuid": "41afb144-ac8f-41f6-804c-33df41c88418", "value": "12288:bQOsjN7IQRzxKvStQyXgSSxIg1vu/vh3XFFfor5KmNXB9ihKRmp:ErjqQRVeSOywSSx91vi5XDf6ApK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618371709, "uuid": "f5a6b3e2-6238-4fea-a947-9c28110254db", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618371709, "uuid": "78a710ab-93c7-4ff3-9ef8-4c64ac9c0cb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618371709, "uuid": "f4adaabf-72ce-4db9-b884-08c9dcdb2790", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727fd16a-9d4e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424581, "uuid": "228a1f6c-2f93-4e61-8cf9-14675266f0e5", "comment": "Malware payload", "value": "9df9fb2f9c8c1604a05c9162f6c8c70b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424581, "uuid": "359502ec-2cc5-467c-9922-fd9f45e8d5ae", "comment": "Malware payload", "value": "181d2be81ca26b9f1e0b809a1a65e7023ece8d6f352c1035dce934dd707ac0e4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424581, "uuid": "fff7a9a2-8d9c-44c6-88d4-afaedb5dfb40", "comment": "Malware payload", "value": "169352f1283cf7abc43538651a922e6f1f12fc2a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424581, "uuid": "62e7cca8-69b2-4239-9d76-71c50797e1f5", "comment": "Malware payload", "value": "a679504a1a8096b03bab57aea1376f596e78396bc3838b67ab7648d1cf544ec03c31753c16b6315df4f2a76c39096b90", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424581, "uuid": "7337daed-b30a-409b-be23-6b46e060a146", "value": "69249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424581, "uuid": "aae20a22-2098-4af5-b1dd-9bb467e72e36", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424581, "uuid": "5ca2c610-a7cc-4e80-8155-1f88333e4b73", "value": "3072:30DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:2pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424581, "uuid": "4f53d31f-cfa3-4148-8e27-406087b6361e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424581, "uuid": "8f366257-4361-47ad-978b-6d04a4c8d80f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424581, "uuid": "689cc2e5-6ca2-4bdf-8a70-eea9d0606143", "value": "181d2be81ca26b9f1e0b809a1a65e7023ece8d6f352c1035dce934dd707ac0e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044b0727-9ce1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618377581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377581, "uuid": "64de8db8-1f7e-4c7f-982b-b87e2e0884e9", "comment": "Malware payload", "value": "96deca668432e43aaaec5828d3f33f5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377581, "uuid": "2d764afe-79b7-4cb9-ae5c-3009a223da13", "comment": "Malware payload", "value": "1a560ac33befb583e144f51d9b9ba105747fe7e039eafdeefb6ebe0d91b56f41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377581, "uuid": "5803b43f-03e9-46f6-9d37-e98d52763411", "comment": "Malware payload", "value": "16b837cd86bd90e96af13b67c69dbe386881721a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377581, "uuid": "49813559-0e78-40cc-b925-2e25422090d1", "comment": "Malware payload", "value": "3472ab9004f2459aa139b36fb6f9dc894642ed977dec22f01eee20b8db15fe5fafada2ff54363e95662526738eb68391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false }, { "name": "Shellbot", "colour": "#7FE27B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377581, "uuid": "57decc87-9047-4874-94b5-c4c66130c02e", "value": "9DF56B07A6E340BCC5A2C0344B9F9166BF39F45752157B6A349C92713F43E348FAABA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377581, "uuid": "d114b083-6f80-416d-a03c-03b3d76c67a1", "value": "98304:5kwXPPPPPPPPU8PPMPPPPPPPPPPP6PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPy:qwXPPPPPPPPU8PPMPPPPPPPPPPP6PPPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618377581, "uuid": "2bb047d7-5907-435c-acac-73695c2c707d", "value": 3476310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618377581, "uuid": "b5b54ff5-e8ef-455c-a28f-a8fb3f973ca4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377581, "uuid": "142bf227-b295-4b68-9da7-4a28c89c69ad", "value": "legend", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84a990f-9d61-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618432886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432886, "uuid": "95f30418-489f-444a-85f2-1eed6a54552e", "comment": "Malware payload (AgentTesla)", "value": "c13cf98a3d1f612ec4855b03fd0c98ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432886, "uuid": "707be1de-3249-4608-9058-a3b477a4a59a", "comment": "Malware payload (AgentTesla)", "value": "1b2fd5166fad313c7ba9b02ad3c9ac3e1289d436c0a52453e446dc600cc5d0a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432886, "uuid": "c91b8bbf-3a17-4089-ab0d-bbe70e18b727", "comment": "Malware payload (AgentTesla)", "value": "1659fcc7cd69d224a599c4a8263eb06e217b293f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432886, "uuid": "119ab1d7-c9bd-4b7e-ba4d-68fd0dd749d9", "comment": "Malware payload (AgentTesla)", "value": "23bc8e6516e5a09944cf4622f7994d559d907db9804cfae4805a7b0578bd131b225b4e386072d38c69adc9b792866d8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432886, "uuid": "f94965c3-d1cf-4e1b-a0fa-1516bcbb588f", "value": "591533E082BF656EC63DB7BC0ED9737BD61386669643954E1A920C3DA9F4A413CC02D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432886, "uuid": "d5322187-11ea-4ede-936e-b47eb009b87a", "value": "24576:qhcFKMFUMV8EzS6QXTOQqdRXiTk13H3i4FsYwxhG8qi:stenV8t6QXTO7RXiiHdONxhBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432886, "uuid": "7c8448de-8739-4286-9b5f-f036e8274d45", "value": 943046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432886, "uuid": "4ad13c90-c162-4db8-a4cf-dfd2688727b5", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432886, "uuid": "2fe8d737-0ced-4365-abac-d3380cbd7ca4", "value": "NEW UPDATED SOA.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3d3177-9d42-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419306, "uuid": "9b99a989-b503-49bc-8cb5-e36967997e00", "comment": "Malware payload", "value": "0416039fb76933405c94fdbce13594db", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419306, "uuid": "51c85681-78c8-4f01-b8fd-554a4a2b1cd5", "comment": "Malware payload", "value": "1cde060ab9ebc78c4f3bc9758860e48eac68f1e8f45acd0748d785c1246fc9ad", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419306, "uuid": "e528f3be-86d3-4c66-afe5-599250ff7912", "comment": "Malware payload", "value": "d6eca99d5050799d265b5c48c63a8452f073b94f", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419306, "uuid": "e6daac89-8138-4a50-994b-6a85a3c489f9", "comment": "Malware payload", "value": "d41e63d039b9a5f08ff252e57003b0a8eee65f5902ff2c2a364fa1d54c87c8447da241be82d99f0a55d1236651b06e6c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419306, "uuid": "31e50acd-a5a5-40f2-b42f-84cd371dfabd", "value": "08F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419306, "uuid": "223b089b-c7ab-4c7d-94b3-ad3fcdbaee5b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419306, "uuid": "e4d59378-33c2-49bb-b373-adaaba7b7b18", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419306, "uuid": "b778191c-0ad7-49de-9b11-3902ed09b9a1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419306, "uuid": "3399a3ea-1cd3-46ce-8324-ebd2b9f2a68e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419306, "uuid": "7f36e953-5360-4d3e-9926-cefcc15b2fbd", "value": "1cde060ab9ebc78c4f3bc9758860e48eac68f1e8f45acd0748d785c1246fc9ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96043bc3-9ce9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618381262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381262, "uuid": "a1350e05-0316-49fe-9434-1eedb5032707", "comment": "Malware payload (Formbook)", "value": "f5115553d0433a580295205d6c8637d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381262, "uuid": "088c7f40-ca12-40f1-9d91-9903c398e0ae", "comment": "Malware payload (Formbook)", "value": "1d3e01fb6e4f61f482bf3bc2628b5141a896284973eaa50c35bdb929a5aa541b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381262, "uuid": "bc32e08a-0a4b-4047-b142-1542303f4751", "comment": "Malware payload (Formbook)", "value": "585b40551ce2be9fb371d2492521b2e70ba716c3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381262, "uuid": "51c7f1e7-669e-4032-b102-b1c64f3e5a0b", "comment": "Malware payload (Formbook)", "value": "66bd8a00ed6029a2a0fba9ff8b773db0d299bf28385531e9aa1426f23b4b95505ec2b96482f4333d6a6345bbfa367d2c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381262, "uuid": "61281a35-cc96-4ab9-a008-e06928237433", "value": "0665123237A8A793E17E563818B201C502F6FD147562DA4F3CF4B48E2AB17524762B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381262, "uuid": "e637476c-a8f6-4bb0-9e33-749103c01f09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381262, "uuid": "77f08e2d-94f3-4ec0-945d-d623765f3b83", "value": "24576:Tcxo5hfo5hYs/TVe2IN5L2op5Oq1/jfuZsxDqCzuaeF/YyzrNA7stTcCPwn45PN:Te/TVel7L2OTjWZsxDqCSaeZDEsNcCPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618381262, "uuid": "3b20ee94-dbc3-4bbf-b06f-16e90dde6c6d", "value": 1520640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618381262, "uuid": "2ed2da0d-3149-4e69-9f82-f3ecc4f89252", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381262, "uuid": "4932cb4d-2f47-4d01-a04e-2af784b6a972", "value": "Betalingsbekr\u00e6ftelse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd465e5c-9d6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618438880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438880, "uuid": "c3cf6f42-ce18-4cc7-b1bc-3516f7562c30", "comment": "Malware payload", "value": "d79ba9d4a58130c7cf8d47fd7c3ed3b4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438880, "uuid": "8be621cb-f3bd-4455-a827-f74a34d3231c", "comment": "Malware payload", "value": "1d60d955347187e847bb7a621381f058f385b81f8bad61138f087ce8bc1e72fa", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438880, "uuid": "2e5a744d-fd7f-4682-823e-309d2dfc60e8", "comment": "Malware payload", "value": "de2fc0926556590781e170fdbf17414146bfe277", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438880, "uuid": "1a73a814-f9c1-4282-8dc1-3320c72be10f", "comment": "Malware payload", "value": "9ed1072f6768ca13003217caefbdeaeb7574de5ba03ad14e589ccd7d7379c3b488c2a644b094eea0866bd76206d0b47d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438880, "uuid": "afdbda03-fbc7-4465-af6c-ba7fcb09e3b1", "value": "F7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438880, "uuid": "7dac0758-b075-4baa-ac3c-d4faeaa1604f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438880, "uuid": "b49fe5d1-3188-47f7-85ed-e0f0a699cfd7", "value": "3072:Nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618438880, "uuid": "8d617194-0f0c-46a9-b9ba-3bb4024ea44b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618438880, "uuid": "a97da26b-5b2a-4ccf-939b-ade3a66562c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438880, "uuid": "a3714596-9b44-4328-9303-591cbf9f3154", "value": "1d60d955347187e847bb7a621381f058f385b81f8bad61138f087ce8bc1e72fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2380801a-9cdf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618376775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618376775, "uuid": "7162cc13-b046-47d4-a6e8-c098f5ce6400", "comment": "Malware payload (Formbook)", "value": "cd863d6878b34b849f9990b0a4d2c96f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618376775, "uuid": "0ad374ef-d7dd-48fe-ad2b-e57fb1cec8a9", "comment": "Malware payload (Formbook)", "value": "1e0cab31bb6c690c4760c85bb8243762ba843c7bf3c1fd24be56be13fcfe7544", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618376775, "uuid": "b320e5e7-f04c-4bd6-bd2f-f2b4a10b6583", "comment": "Malware payload (Formbook)", "value": "d9fc7344f86c84fe8dbd357d80f7efb56c55a44a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618376775, "uuid": "ff82cbe5-9044-47e3-a739-ef7db5034463", "comment": "Malware payload (Formbook)", "value": "302b2e8883661208b2892571c879ce5b84c22faa7010e24911d829c080bb6d915a99817e1d20d92f7a4875f0e9033c37", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618376775, "uuid": "28499635-7d26-401b-85ed-f8a78269ce61", "value": "582412F007C4432C7B47909A6F7D44A9EF4F3B618696D3A553BE6A23089F833D2DA944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618376775, "uuid": "7d09839d-0210-4b64-a146-a95c9fe8447a", "value": "6144:KB/72tKD6roIdQDDGQYv9U/3/bWhradLJR4DkjJ:MSgD6roIdVfyzWAdL0oJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618376775, "uuid": "4d2c420b-7955-4c45-a46f-3f43f2e23a1c", "value": 220592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618376775, "uuid": "4cc65a94-77ad-4cd1-8edb-be279da83083", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618376775, "uuid": "11b0f290-633b-4f60-bf98-1e6c38f42a0f", "value": "85674.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6987f32-9d5c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430789, "uuid": "7adb1917-3663-42cf-8649-06b7b18f0fb6", "comment": "Malware payload", "value": "446b41d1808015953fdbaaecde4f56e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430789, "uuid": "edad498b-9282-4817-96be-a427b56548bb", "comment": "Malware payload", "value": "1e2651a00a9fc676e3bf97fc7863953fd199baf8e0fce6f5974cfd8f1a4459c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430789, "uuid": "14b7394f-66a7-450e-aaec-0035507f1d7c", "comment": "Malware payload", "value": "27ca71f658741da3b6145ef5d9dd40b0d22e2c76", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430789, "uuid": "0485726e-3d9a-458a-86e9-772ad075d663", "comment": "Malware payload", "value": "f656980dc8c01cd10e2b0baab171fe73534877d056195b2918ee835b5777d1f8f1bcd0d8ed80a681005684826b5ae941", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430789, "uuid": "64d62caa-d117-4f9c-8ea1-79b07e2489cc", "value": "2A140786B592CC2FCB8801384CDACFF9A6A2BC45DE44A1873144FB1E3DBE554DBA6351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430789, "uuid": "72a18aa9-03f4-45dd-bd59-07a50e6a301e", "value": "3072:OJ4OHiqdxJeMGqJESO5lR4DXhf/Yehbv/p1QLHm9O3DC5Xp0:k4OHiqdjeXqJEHaDXhXJzp1qi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430789, "uuid": "0fcc30bb-0c9a-416b-aa1e-c10259b71584", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430789, "uuid": "1dc7fd98-51ed-44aa-ab64-5e6f602156e3", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430789, "uuid": "46ffb704-b2f1-4d84-98de-b6e5abc58e1a", "value": "SecuriteInfo.com.VBA.Amphitryon.166.15257.23144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2b0325-9d56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618427873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427873, "uuid": "5e87360b-ac31-41ea-add7-117bba31c243", "comment": "Malware payload", "value": "f41d0cb710640b01e64c5c0cd57d439d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427873, "uuid": "164bf94e-ff9a-4b7e-b433-e4e33c13b276", "comment": "Malware payload", "value": "1e3a3a4bf1083910fdca5163c41f94e2fe74ef1c7ba016a45c7f0452f6017352", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427873, "uuid": "a8196388-b022-4b5f-ad2c-c8a9b6ddedd3", "comment": "Malware payload", "value": "32923f0501bc37f7e053756ef1036e385f7b65d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427873, "uuid": "9736a3b4-809b-450e-bf8d-ca9fba280140", "comment": "Malware payload", "value": "7b0b3f0ffef28c5513e2cf373aefa18e3ab893fb4d89940436488ccd14bde11ca0561ca4eddb5f2da9e8e0945b9dc951", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427873, "uuid": "b9aefdbf-3a5e-4687-b957-8c5e1ef2530b", "value": "2A930228E6F25127DE75647FF6134DB22B1A3401B371995B3480849A8CCE5F386BB8DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427873, "uuid": "2805cb1a-699b-4731-b100-77c13b52dddf", "value": "1536:Logmwe/goi7gPHjPPLIW+7osUJ4kfeeTE0hJMcPmaDpdSu19ihOWi:Lol/u7gPDMH84kGf6JMcuaNB19oOWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618427873, "uuid": "2b44e74b-6e2e-42d3-ba9a-44c638623f8a", "value": 96451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618427873, "uuid": "a3bcf9a5-7db0-4cab-b989-3329ecc878fc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427873, "uuid": "6e733c66-c7a9-4b78-a175-d2800abb1f99", "value": "documents-1321106901.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d739d1c5-9d45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420885, "uuid": "0ee68b7b-07cf-429c-805f-25e289e8f002", "comment": "Malware payload", "value": "04b56908409c4b325d594426e24f38bd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420885, "uuid": "d8284ae7-a2b7-4192-b59b-978511778cad", "comment": "Malware payload", "value": "1e7205b1a469abe61d26764f44f56d002e71cf4b254b9ad1a6d295e3b3fc0448", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420885, "uuid": "d47550b6-a57c-4d3a-a757-1276004fee79", "comment": "Malware payload", "value": "534e8b277707e4c22796e659984d9a2d91493fcc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420885, "uuid": "4b58f689-680c-4ccb-831e-65f3ad4a1674", "comment": "Malware payload", "value": "4f53f39b7c9999f04473516637f86e70b5f3eb1a70d14148db5c64d4b80da6391b406db294d8bd85de4dd9648ccaaa13", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420885, "uuid": "57d49992-9d41-42bc-aa74-6d1c71ba7e39", "value": "65F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420885, "uuid": "16876c34-49d5-41bc-b40d-bc6bca9e03df", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420885, "uuid": "58c34318-0c12-4a91-b354-0da82e68af4d", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420885, "uuid": "514bfa90-0d8e-44ca-8ec9-14c44835431b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420885, "uuid": "b29baf33-6835-4a05-8805-c8061ab42e98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420885, "uuid": "cab1717b-f058-44bc-90e3-c0ac2d4ccb39", "value": "1e7205b1a469abe61d26764f44f56d002e71cf4b254b9ad1a6d295e3b3fc0448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50f26a9-9cf0-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618384374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384374, "uuid": "ce611c5d-23c0-4f78-8c1a-bcfe8a4b7c61", "comment": "Malware payload (RemcosRAT)", "value": "d1a19c7f4e58e0edd3d97e9c24ab21bd", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384374, "uuid": "1504616c-be23-494c-be36-94d5ca044b56", "comment": "Malware payload (RemcosRAT)", "value": "1edeede1f752bd813d40e99af6e7a582960c4eb03615750f0b76c9b59cf4fb24", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384374, "uuid": "247cdeac-6e69-429c-a9db-6a5913169a7d", "comment": "Malware payload (RemcosRAT)", "value": "6e7d3d7b3228bb10e0ceb3949237716b4dcaece7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384374, "uuid": "edd4f5ca-d692-4423-998d-b80c5670679b", "comment": "Malware payload (RemcosRAT)", "value": "948cdbb52b3b11d650a3a0d47963620cbaaa5b3345f405cc8b89f41d4a6d3e2186e69f8d7d7372ee036e19bf97aae785", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384374, "uuid": "e7494852-10b9-4f3f-aa84-1438064c85e1", "value": "16D423FB4466A5F0B4A7D60126A9AE7B107E247142C8CDCA426656C037DBF63F31D2B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384374, "uuid": "2bd1bf97-92ba-4fb0-a7ed-391829838638", "value": "12288:rUleX1pC8NhnI6z50CpFuOtSOfKqT5V3Cav0BIn5gH5LofR:rbpC8LI6z500F3tSOiqT5Zjv0BB0fR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618384374, "uuid": "a9fe3185-87d6-4805-9ac8-99cd048b93f1", "value": 598703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618384374, "uuid": "fd13e8f0-b972-44ef-ba1e-b01d637badb1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384374, "uuid": "2c709b1c-51fd-44bf-ba0e-dcf7642ed96e", "value": "New Order QDT 2068864.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16be693-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425143, "uuid": "462d4de7-7fea-476e-b8fa-89c0ef166b9f", "comment": "Malware payload", "value": "960e9fd7eab64ef392bc3adf7b225056", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425143, "uuid": "5a727abd-f224-4b2e-a41c-6064fd93bc66", "comment": "Malware payload", "value": "1fe54d1eb717938d32cff5e9da80d2caab7ae63db7aa82ecd2c10888296ff694", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425143, "uuid": "4a2681ef-7698-48c2-8c85-cf8416844643", "comment": "Malware payload", "value": "3c0fb017dec6fc19fc287f4950d9c4a3ad8a8753", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425143, "uuid": "4450caaf-f444-464b-8c49-d7df4099a5ca", "comment": "Malware payload", "value": "ed1021fd3a6b2a02aac433263e499480cb2b4ee8e50549e71b2d98c9629319cf6adeb56e41c6d279547b1ad9c78c00ea", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425143, "uuid": "2687cb0e-81b7-40ef-affa-772a93245666", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425143, "uuid": "9ebb3cb1-f5f4-44c1-a620-66ae89c335ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425143, "uuid": "11b0083d-31fc-4d7f-b149-71e652f99374", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425143, "uuid": "f00e8702-5b3b-4871-a28f-fe556a9b0fb9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425143, "uuid": "8b870fc2-28f9-413c-ad9d-ba178467d703", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425143, "uuid": "afa489e7-9968-4838-bb08-ef837daf2e34", "value": "1fe54d1eb717938d32cff5e9da80d2caab7ae63db7aa82ecd2c10888296ff694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687cdd7c-9d45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420699, "uuid": "f1ac46c1-9772-45c6-a553-9eea777ed4a1", "comment": "Malware payload", "value": "04c2a1384f6a3468677c211c0a118536", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420699, "uuid": "f6284a88-79c3-4aae-a9b6-f3bf50fec736", "comment": "Malware payload", "value": "20c402e4c12041a09dd781c1ebbde0944917147c2fe9e51129b4d201ea306e22", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420699, "uuid": "3fa45aab-5146-4a28-bb51-c9b1e4b8f496", "comment": "Malware payload", "value": "b6dcc3b6cb64c0093f5effe38f875a9dfb1cc67b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420699, "uuid": "a99b2381-3ccf-4577-8fbb-1b42d52ceddb", "comment": "Malware payload", "value": "3b4ccedc47cda84f3cabd328c6413a2d61068edc9dfd72191b0b17d951f7d19a330ab10ea0355e29192e31bddc005670", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420699, "uuid": "2f7981d5-7deb-4d14-bff7-ad21cb08c8a3", "value": "07F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420699, "uuid": "263d843d-353f-4008-824f-5f51f3d6522c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420699, "uuid": "80b9c242-6bbb-4ef1-8998-f5e6da952651", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420699, "uuid": "6e683b40-a86a-4fc3-8d73-99cec89d2065", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420699, "uuid": "fc2899f5-f007-4dc2-894f-f0a5c3053a80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420699, "uuid": "9a73307e-c9e5-42b4-a0e7-12d13286f8ea", "value": "20c402e4c12041a09dd781c1ebbde0944917147c2fe9e51129b4d201ea306e22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0fc2f28-9d3f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418351, "uuid": "5e921e07-adcb-4024-9240-70a5be8c2efc", "comment": "Malware payload", "value": "731cd1cf514d0a6985e5e511d6103f72", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418351, "uuid": "3aea02a2-a68b-4bbd-b107-5a27e5ac9539", "comment": "Malware payload", "value": "20f9902891e05ea6d3dd9ca9628c61de44591de18e0fd83c3a2aa5089c568c3b", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418351, "uuid": "6c155ccf-60f1-4b64-8e15-865435e950fd", "comment": "Malware payload", "value": "2d472ce309d6a7409edcab03c9e5bdb6e091e858", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418351, "uuid": "b29d63a0-4ddc-427d-8ff4-8bc25c422938", "comment": "Malware payload", "value": "9110348c0f2d196f3d8413b281f2e8e102297f4b7a2b845ebc026ec06c102b438f1a9e4b5c4e8713c70f7be2238ab57d", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418351, "uuid": "bd7b5797-058e-48d5-a879-a3fae2266feb", "value": "9BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418351, "uuid": "4bbeab3b-6d8f-4fe3-a0d5-31b7997e872b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418351, "uuid": "39b8ce71-adf6-40de-8112-601e52d4c8be", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418351, "uuid": "3da4a71b-f9b0-48b4-bec5-f4d57eba3675", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418351, "uuid": "ee8af930-a34d-48e2-bc58-5b691bd7d490", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418351, "uuid": "028b85f3-568c-421c-bb78-d2095324f9be", "value": "20f9902891e05ea6d3dd9ca9628c61de44591de18e0fd83c3a2aa5089c568c3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8680a0ae-9d4c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618423756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423756, "uuid": "08741a22-e02d-4890-8d41-a584f31d702a", "comment": "Malware payload", "value": "e7d0e9d0da5a856836b10315cd407e23", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423756, "uuid": "3d2271a4-a3d7-4b02-8967-4a851806ba1b", "comment": "Malware payload", "value": "24a0c2b6a0d6744f78bd50838e4ca5739a39cacd52966bc0add87a3d4b303c1e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423756, "uuid": "413d587e-2dc9-4b48-ad6a-6d42408df860", "comment": "Malware payload", "value": "ef91648db8dc88fba18a03c7270946748c64d59c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423756, "uuid": "fa182b73-9b3b-498f-868f-2963e0161999", "comment": "Malware payload", "value": "7a71e4286feb98cdf0c8ccf5bcc828fdcdfafe23d749d77bbdff2c384655dca93e94f4f8a4004c93623196eb2e15bd85", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423756, "uuid": "30229d90-5557-4aea-9dd3-2ed6311426f1", "value": "54F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423756, "uuid": "9fe80ea5-6f0d-432b-a602-042cf90c1147", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423756, "uuid": "7d44a6c5-6e6a-4bc1-94d6-e6c68d53dfcd", "value": "3072:Clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618423756, "uuid": "d00c31a2-9d65-49fc-95c8-a427d5849533", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618423756, "uuid": "23ed77a5-ce25-4529-99e8-cfd6c9714801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423756, "uuid": "5f6b7618-5be5-4387-9f66-372190bbae96", "value": "24a0c2b6a0d6744f78bd50838e4ca5739a39cacd52966bc0add87a3d4b303c1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a83cf39-9d3c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618416918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416918, "uuid": "4aaedb4a-b5ae-4917-ad15-54daabb6742c", "comment": "Malware payload", "value": "cc521ea320428104b7eabdf39dd789be", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416918, "uuid": "10018f1f-ac0e-4ff9-9d2f-0a2b4c7745ec", "comment": "Malware payload", "value": "255879b2eeda763787cb14806d2d4d346a0ec05cb2361a3bad2a385fb1ad2e28", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416918, "uuid": "34fb52b4-5bf3-48ec-9de4-545fdd0252bd", "comment": "Malware payload", "value": "4ae6547e206787fc2789b67e19144144ae656111", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416918, "uuid": "998c8f0b-75c9-4d02-907a-9034b9c946df", "comment": "Malware payload", "value": "18fd43677d6ba101b195cff32b82eea7b732fc89544c4c01c88a72102f9f69b750ece3fd7c9975453168ec9915e16e03", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416918, "uuid": "08c1243e-68f2-4712-8cf2-53f4db7b87b7", "value": "B9249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416918, "uuid": "1a740e7d-5030-4ef4-a159-ef7d7aab415c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416918, "uuid": "fcf13291-dbb6-455a-8ac0-b5def32abdd5", "value": "3072:x0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:kpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618416918, "uuid": "667fd697-d555-4376-bffb-b5b8bb2345ca", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618416918, "uuid": "611ba938-f845-41e4-aba0-cc10ecb26641", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416918, "uuid": "93b74109-47ab-4a01-9270-c2e7762904a8", "value": "255879b2eeda763787cb14806d2d4d346a0ec05cb2361a3bad2a385fb1ad2e28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655f6fd1-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424989, "uuid": "20e2455f-b2d9-43bd-88ab-a9e492ce3172", "comment": "Malware payload", "value": "5edba41a1dd5184586b1251670bf19dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424989, "uuid": "7cb7cf7f-5e35-4e8d-a687-7fc8a84e4c6f", "comment": "Malware payload", "value": "2660efbe253523dcaee2e6fdd7da208e084b4ed8cf7e59906a2e3e83a303d087", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424989, "uuid": "010589f2-5908-470a-a183-41639aeb2d5e", "comment": "Malware payload", "value": "ec961290c5d629545378dc939e4eaeb02f89212e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424989, "uuid": "29fff7ac-c254-4bff-826d-07afbc5424be", "comment": "Malware payload", "value": "e7b69f704ca807fe1a846851cfca01444abf72a297e98607b33c839ef7e226646afafda021d8cae02967151f7366bb30", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424989, "uuid": "f0ef929f-7f38-4945-adff-37bbc7862dbf", "value": "721501017592D933D51705394EBACBFA2B79BC72AD248A4737C53B1F6E313A0DA21386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424989, "uuid": "b364245f-e9ce-41a7-8e74-109d154c857e", "value": "12288:FB+j1ZLrnGtiI4hLrZxl3In4RjkzlEhiG2BL6+QQCth8ZexU762JcBS5xOWArL:FKEiZxl3A4yJJG2dPQQCthWu2G05xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424989, "uuid": "3434da98-0116-44bb-bc63-3325056cd9ad", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424989, "uuid": "5426a7a6-ce30-45f6-85bb-bbb5cb3beeb6", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424989, "uuid": "a8c01a07-cd1d-45a7-b224-9eed1acc7f7f", "value": "0414_1906406106610.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0a8fa9-9d5c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430721, "uuid": "82ab344a-74e2-4d8e-872d-d171f09d64aa", "comment": "Malware payload", "value": "e1b2c0aa2862803da121c241dd8d4aef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430721, "uuid": "cbfa56fd-d033-4a87-ae9a-0cf60a264d19", "comment": "Malware payload", "value": "26cedbf0b944eee946f337d1df5cacdf603c1cc847563f70de7098872420e185", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430721, "uuid": "a92cb11f-69f7-4b69-aa4a-74a5f9b44c81", "comment": "Malware payload", "value": "44539017fed3c32688068727ef30b9fd25d1ecea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430721, "uuid": "914b815d-be60-4b40-b24f-4da92af2739e", "comment": "Malware payload", "value": "a2fbb01ad557af9d72af9cc0fd1a28652a600b2e16d8758077d0c31a9f55c5c332d6dfc5006f43b0cf88b372f16567a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430721, "uuid": "775a3b7a-3c80-4fa4-9dc6-3333c7976e11", "value": "245422C096A62D1DE30B1876D23185C2F9A9F5F9E8847488D9D433E12796712F74F3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430721, "uuid": "177c0c33-f124-4c2a-b750-f5ad0e6eee10", "value": "6144:N0rtT5TiMOez545U10NVItVgitu/zoWkYwF3TmazdFvyVbe2HG3QKRFoTNZ:NI5N9CtItRY//hw9NvKbeOGAKRFo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430721, "uuid": "b5c1a766-f090-4127-ae7d-464acee1487e", "value": 301229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430721, "uuid": "9ac5cdca-50cb-4d11-b2df-ebcbcbcb0587", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430721, "uuid": "e9232fcb-215f-4baf-90c5-8a7e294d9560", "value": "SecuriteInfo.com.VBA.Amphitryon.183.5919.2818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbee2922-9d7a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618443656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443656, "uuid": "eadc6ace-4c49-420e-9808-449ea767777b", "comment": "Malware payload", "value": "b9a17d76b9cc52c14d1d8b8926a48e07", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443656, "uuid": "a55720c2-c41a-4a27-8ee0-47a16a6ecc28", "comment": "Malware payload", "value": "26f68e2d605129751be73fe8e210b81b11bfd98d978eff695b3becc617e1ed31", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443656, "uuid": "8af40015-05d4-428b-aab0-2d47a5d33ed7", "comment": "Malware payload", "value": "0025d80b9453c610620e8c5dc0c981bd47179982", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443656, "uuid": "0330cc16-63ed-4819-87fd-9ef7a3b44ebf", "comment": "Malware payload", "value": "44dab6c973f1d0c5295cc968cfccde75fcc5cf7935dcfe9ccf983e240bf8640dab5c84b5ea50bcabc9e44b8e92415083", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443656, "uuid": "843b2e61-c833-4591-880b-67814fe1e089", "value": "82F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443656, "uuid": "d68c27f1-256d-49ad-a20c-a1f3fad6f7b4", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443656, "uuid": "41137315-9451-4604-9f78-404b25058393", "value": "3072:Dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618443656, "uuid": "e176f283-9c1b-4cea-9f39-6f86c3e18946", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618443656, "uuid": "2eafbbd8-08f6-4100-bbf8-63bd0992ca46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443656, "uuid": "fe0ce75b-01a3-4db8-920e-99557f1259c5", "value": "26f68e2d605129751be73fe8e210b81b11bfd98d978eff695b3becc617e1ed31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51c1409-9d60-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432531, "uuid": "48015936-7155-4792-9e25-a6263c8df896", "comment": "Malware payload", "value": "a4b8e1035579c94bd49a5f62635f553f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432531, "uuid": "2c1bbe41-fbdb-48ff-a541-93bf0f09b3b3", "comment": "Malware payload", "value": "277206e9a6852de750324b42c6355c9115608cfffe8f8a5589f175b3b17693ca", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432531, "uuid": "e19aec90-32ec-4338-af0c-a3acc9cbbb24", "comment": "Malware payload", "value": "5ae6b9dcfa67042f8b7a587dffb99cd5257ee23e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432531, "uuid": "b35bbbb9-bbb5-4293-b1e0-3fdf3df34bd2", "comment": "Malware payload", "value": "83a47bc419ae4f91f6ba67b54a1167df2b50a2f3dff51cad6ade2d7400432ce11c9d03c50b1acbe7aadd72ccd5179513", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432531, "uuid": "d3799204-c4b1-417f-bc0d-495073b059ba", "value": "F1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432531, "uuid": "78d0a933-a429-4dce-9c2d-eb9112a0f07f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432531, "uuid": "f80e1f97-769c-4426-8881-adfc777ad428", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432531, "uuid": "f079d66e-1b87-48c3-b1e0-55b97814b07d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432531, "uuid": "258f2c62-b368-4a3b-80f6-0527c74f3791", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432531, "uuid": "6beaa717-4602-43c9-978a-a20a01345bf0", "value": "277206e9a6852de750324b42c6355c9115608cfffe8f8a5589f175b3b17693ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5560894b-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424962, "uuid": "5ffeabe0-933d-4c66-9add-b2183c6a8b6b", "comment": "Malware payload", "value": "453be12d12094208a9e44841fc252975", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424962, "uuid": "f0592e50-a92c-43f7-a880-97052db4f73c", "comment": "Malware payload", "value": "27922213014657f9ba53f618dee9ec58f5ed9bae68e02f6c05d28e1c3f18d327", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424962, "uuid": "41f575e8-8271-4734-87dc-856f24e0f758", "comment": "Malware payload", "value": "1a44ad42c39bb39185f54cdf896121152215d5b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424962, "uuid": "55401ee3-f1b2-4303-ad56-0b9db2bb1c24", "comment": "Malware payload", "value": "861e45a4ebf8c9cd1dea3cf1f9c1b6728e0ced812274d150cda6390474ed38ab4f0fc9cfa1c8e87649ba3a3d603e4cac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424962, "uuid": "b4143e3d-0f2f-4edf-95ec-051bc897c402", "value": "A71501017592D933D51705394EBACBFA2779BC72AD248A4737C53B1F6E313A0DA22386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424962, "uuid": "2f7508af-8576-4190-97da-a4fd42e52fbd", "value": "12288:aB+j1ZLrnGtiI4hLrZxl3In4RjkzlEhiG2BL6+QQCth8Ze5U762tcBS5xOW6rp:aKEiZxl3A4yJJG2dPQQCthuu2q05xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424962, "uuid": "cfd8abfd-ecb5-4433-9e4b-d522a3ec65cf", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424962, "uuid": "0637548e-9a48-41f9-86f9-c7de488046f8", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424962, "uuid": "8ad87f3e-dff4-4866-a11b-a7cdf739374a", "value": "0414_967638217736.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531e1067-9d53-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426676, "uuid": "765cf826-e974-4be4-b982-2de02bb6a0a5", "comment": "Malware payload", "value": "a51ea201a7d01ac8de5069163869b37a", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426676, "uuid": "66b45a2e-4de8-4458-9baf-ab98b1efdd3c", "comment": "Malware payload", "value": "2792f46223554ec129bea31442c36b057ded8eaefec41146e3dc110705ad199f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426676, "uuid": "aaf79535-6a80-4da6-8bfc-f5ed891587b5", "comment": "Malware payload", "value": "a467fb12c1f138243595277b3d9bd008087098d9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426676, "uuid": "1a5ebc0d-a52e-4091-95d6-7e1892adce29", "comment": "Malware payload", "value": "bc0b48018edbf5e8d30a0b36bf4dbc53bb7b98ed694d93b8cb16b57b4f67abd7dd3e377ca6ffbf097248be182ce28688", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426676, "uuid": "7814720c-640c-41e7-b1a1-59f30c8c5a5a", "value": "B9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426676, "uuid": "766272d2-943c-4dd2-b772-20fdf609b91c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426676, "uuid": "e9f34572-37e4-4305-88c0-2a0d6c2ec998", "value": "3072:clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426676, "uuid": "ca96bbe0-6d3a-4be6-a26a-b08375fc7aa5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426676, "uuid": "f034fe0b-8f1a-45c5-b3d4-d5edc0d45742", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426676, "uuid": "a688643b-4eae-4261-9c28-fb0ae1b5658d", "value": "2792f46223554ec129bea31442c36b057ded8eaefec41146e3dc110705ad199f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16defda9-9cf0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618384055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384055, "uuid": "94cbb289-8f4b-4659-ba59-555373be864c", "comment": "Malware payload (Smoke Loader)", "value": "06d9c23ed0ef1ca2243ef5e039b9fbe2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384055, "uuid": "2077d5d3-1792-4007-aeb1-6625970c1031", "comment": "Malware payload (Smoke Loader)", "value": "289c19cf74628058d7012f643351f2bcc6bb0add93689ec7a6248ed4c55a3d01", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384055, "uuid": "7130002b-f89a-447d-9166-48ca46559069", "comment": "Malware payload (Smoke Loader)", "value": "c3baf6f969010c8c08cf1ed1ce7e06d0a4463dca", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384055, "uuid": "364eea5e-4953-4f4f-8545-f4d115cca138", "comment": "Malware payload (Smoke Loader)", "value": "2f789e0f5fb19aba04bde6857214a50a00a557e3f5a37d22efeeb356097b367684f7639751b326d5e91ac3e776bf5a76", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384055, "uuid": "b8474015-ae08-494d-bf5a-3e236fc3e47d", "value": "3CA5F1F01B9494C6D6F6DE422B2A78292163F17A99C509C8F03DFBBC17EB643ED18542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384055, "uuid": "774bd705-b702-4ecb-bc55-140037151241", "value": "24576:hh7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h7h45i:/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618384055, "uuid": "3975307f-f663-4c21-afb2-03680a142b97", "value": 2149283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618384055, "uuid": "4f51841a-01ef-49f4-ba14-c184d48d01b9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384055, "uuid": "84777ffa-104a-45e2-ab17-5f48e610aac5", "value": "2021BR04IS14.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79740dcb-9d25-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618406984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406984, "uuid": "78a7d242-d495-4d40-98d9-838750d6e360", "comment": "Malware payload", "value": "cee855ad2ba03c5ad971237912e47f78", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406984, "uuid": "0fae7dbd-a42c-410b-bb90-3e9f2f248c43", "comment": "Malware payload", "value": "28da3e7f482195efb0309cf214b45a261a95fa0d199f6139d9d610328ed4e1c7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406984, "uuid": "4901354d-20cc-42f6-87a0-075168f8b7bb", "comment": "Malware payload", "value": "db2d500106a75e8f477378bb298ba40f08781b74", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406984, "uuid": "b43159fa-e039-4e04-be2e-601f3b4397b7", "comment": "Malware payload", "value": "365052772e9ec55b0fa2f7862ce2e1862038056a55c8cc72dc1c8593dc101987eae9b35f68e733ccf7a1c9a812ab8a5b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406984, "uuid": "670ff89f-5d7c-457f-afa1-bb1d48db9d55", "value": "CC55335792B3657AA38F73F32103FACA2F2590FD16361006BD6926982538CB111DBBF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406984, "uuid": "89f9372f-f035-4c6e-8689-140163bcd41d", "value": "24576:anG6fztQ1xvzEvHCk2HWJ+ScL6QN9gRuQWxPA1gNBPpfl:aNpQnbEvHC1xZ3goAqLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618406984, "uuid": "5c1ef52a-edc5-4f53-9558-69ddcd28ffdc", "value": 1323268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618406984, "uuid": "954f619a-90e9-4861-b96d-9c50e2a92030", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406984, "uuid": "690942ae-5397-44e4-8e9e-9af86f4f329b", "value": "bank payment confirmation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdde008a-9d4a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618422990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422990, "uuid": "d944f116-1775-40da-b893-1907392c7ba8", "comment": "Malware payload", "value": "afbfb2c471d3fb1124a72b65a33612a3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422990, "uuid": "a9f2d852-eb0e-4942-9d08-b73d2993639e", "comment": "Malware payload", "value": "2a012dafafa4398ad3b979e02d499b745b7e80680746d3d7cbe9be74d90ada94", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422990, "uuid": "3798bd6a-b4de-4a51-812e-5250ab8b3c76", "comment": "Malware payload", "value": "23af9f110886ce000742888e6d5c661c4f9dbc9a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422990, "uuid": "99a2511d-4a93-4686-93ce-191f9527a3b7", "comment": "Malware payload", "value": "84cfdd5e50957fe3296362e9e002eb3f5d4ffc1d5fa07c3311f55b4b1ecdc653bc080327c5ff8521aa05860b2e9a910a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422990, "uuid": "4a32c61b-8481-440b-8434-fffa16e89de4", "value": "38249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422990, "uuid": "95246036-c53d-4c55-8182-a12cb35b8dd9", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422990, "uuid": "031074b7-f1d7-4610-a8d5-7635b1ba417e", "value": "3072:q0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ppepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618422990, "uuid": "e822592f-d6ce-427d-9b18-e88f6126c5c3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618422990, "uuid": "335afa05-8c72-49b2-a66b-e46a73a30252", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422990, "uuid": "e6930c99-ae5d-41b3-80da-fc58277139ff", "value": "2a012dafafa4398ad3b979e02d499b745b7e80680746d3d7cbe9be74d90ada94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bcdf95-9d45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420886, "uuid": "8100bb8c-d24e-4bb1-9ae4-f5276cbe1ebb", "comment": "Malware payload", "value": "9d09456d7ba3a04e79bfa2894c2fd7a1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420886, "uuid": "a638191e-7784-4fa3-b370-7b6758eb888d", "comment": "Malware payload", "value": "2ac859731c7710aaf085ba4165a086ecf28f6e556f81428e4342ea1ad172995e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420886, "uuid": "298dc2b1-4706-40db-b268-e94973ec39fd", "comment": "Malware payload", "value": "0a7365ea906a3912dfe2f8fb1dbb2bc87e9b5b90", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420886, "uuid": "04aabbdd-091b-4c7f-b6c3-26da6729c3bd", "comment": "Malware payload", "value": "f9bee24abb621d787710bfb8c8ce7eed15a4b45531152c4b0eea4e0665af9e8d952963a23a1225f7a705e2b57f0cd5f5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420886, "uuid": "488012b5-44bb-47bf-a16a-a3d46462e14c", "value": "53F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420886, "uuid": "09b797e1-bb6d-44d6-a6c2-ab58a5eca5f3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420886, "uuid": "1538734e-7e72-4154-b0fc-faada50af1ff", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420886, "uuid": "7e81d76d-12d7-4e02-bef0-179ec2bc4f32", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420886, "uuid": "a39a7ee3-30b1-4da4-8fe7-72abf753fa56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420886, "uuid": "8ea1a78c-3d5f-420c-8587-1be92966a86b", "value": "2ac859731c7710aaf085ba4165a086ecf28f6e556f81428e4342ea1ad172995e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fac4ab-9d4a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618422915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422915, "uuid": "a52521e4-a67c-49f7-8e7d-7c3371148bad", "comment": "Malware payload", "value": "8cbeb1565ddbec3797e80a8a28b5544f", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422915, "uuid": "3f3971fe-3a6f-4ee0-afd4-b6aef8e45b8f", "comment": "Malware payload", "value": "2aee01d3b12f11ca7defee28da06fd239fc521ca5e6e1f756a411ec1bdf2a27e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422915, "uuid": "d3922369-9649-4d84-8a0b-e727c2367951", "comment": "Malware payload", "value": "c1cd9a4813ebe5fcf30f0a78b4ce6512881548e4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422915, "uuid": "183d8e96-aed7-44ed-8890-169c8b9e6da9", "comment": "Malware payload", "value": "fc07ce6bd28b9c805f24253c406dc7f0d5718b4ba8ab8133e021a9d14e815c7eb617b8949b40f4e236c1bd00a146e4f0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422915, "uuid": "0e573b63-a91d-4b05-81cd-5be152993cce", "value": "24F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422915, "uuid": "46c7fe5a-520d-47b3-9543-deab747f39a6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422915, "uuid": "be9e2920-07c5-495a-afb7-e797ac17ef63", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618422915, "uuid": "9aba7b3e-54f1-44d3-9fc6-766781b268cb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618422915, "uuid": "14b6ff1a-5c70-4339-b2e2-9c4ce87bf328", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422915, "uuid": "af3d4832-5530-4143-8696-7b6fe3225f4f", "value": "2aee01d3b12f11ca7defee28da06fd239fc521ca5e6e1f756a411ec1bdf2a27e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb9ad91-9d48-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618421866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421866, "uuid": "10c0012e-8db1-4a1b-93ff-cf6a877df45e", "comment": "Malware payload", "value": "bcbc136d9ea4da6f3e4e788eade9f41a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421866, "uuid": "98b13719-fbd0-4a62-9341-13074221fb96", "comment": "Malware payload", "value": "2c371b2c8f300b7ff87ee01bbe5c423b776a7d17d4acba14a9d13c396d164f2d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421866, "uuid": "77c3b160-0365-4419-bece-7c95ed67c44b", "comment": "Malware payload", "value": "fb14f5738186c2a1ddcdc683eb91f7ca081121f7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421866, "uuid": "21659512-ee7f-4991-87ca-52ab544d4072", "comment": "Malware payload", "value": "8692f027db6aa48ea87149088a7e1fa0c3e160a027144119a2b53a930216a46e763058e629fbd183b09d3cc258300bd7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421866, "uuid": "b92f196b-1e3b-4c78-ae56-ef1128606fd3", "value": "77249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421866, "uuid": "fb1fd96f-b4da-4b0a-bbd3-4d3df148f281", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421866, "uuid": "6c9a3835-8d6c-4f8f-9086-196c2378b16a", "value": "3072:K0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:JpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421866, "uuid": "c43564b9-463e-4764-8576-83ea812b8822", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421866, "uuid": "5c8aef14-6c6d-4d22-97fe-91b3dbccbbe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421866, "uuid": "6274b5eb-2fa0-49c3-9007-9b59d3381735", "value": "2c371b2c8f300b7ff87ee01bbe5c423b776a7d17d4acba14a9d13c396d164f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9386f10-9d41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419197, "uuid": "7ea04ed9-6f56-4cff-8195-717fb08e1334", "comment": "Malware payload", "value": "013b1216e8647ef401656789f2a054a9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419197, "uuid": "413eede2-e1b4-4b13-ba06-dc44db1299fd", "comment": "Malware payload", "value": "2c9d9ac623386ba36829faafbc5de14759aef84c544984c395b11a6ced700b66", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419197, "uuid": "2047039a-dbda-47ae-982e-75309da03b3c", "comment": "Malware payload", "value": "51bbaef06f8112c320f7a770864a8a2730e694f4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419197, "uuid": "7104009c-3728-4a2f-b5c1-8ffc2f14cd9a", "comment": "Malware payload", "value": "9b4869f8c1c3a9cadfb52ff0227ea0d8d9cfb6e4cc72997fca089be19e8f30cf3c29aec50651d1312f44ced6aef89176", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419197, "uuid": "7ec28496-b0e9-4ee1-bf9b-67a96f0e3afe", "value": "89249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419197, "uuid": "4ad747c5-ea9d-44a0-b627-a582eca6d0bf", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419197, "uuid": "a768e0d8-5703-4bb5-89b0-9f7263961008", "value": "3072:60DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ZpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419197, "uuid": "3a4177c3-fa99-4744-b9fc-6374b88215be", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419197, "uuid": "15c0f2cf-9372-4c08-8df5-72cacefb54f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419197, "uuid": "595aa3cf-f0c5-41b8-a0bb-143a929ce2c9", "value": "2c9d9ac623386ba36829faafbc5de14759aef84c544984c395b11a6ced700b66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a069ef99-9d54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618427235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427235, "uuid": "4c67564c-7fa3-407a-bde7-7ecad3eff4f4", "comment": "Malware payload", "value": "eadd31348d51687b36e21c04f681ccb3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427235, "uuid": "056ff869-0e06-45c5-8b19-ea203c138e40", "comment": "Malware payload", "value": "2e037edcb1e13e8b0289cf74510faa9d64528e4b29d7a493b078235c8db08f38", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427235, "uuid": "2f712265-d399-4058-b45d-126a0cc48889", "comment": "Malware payload", "value": "e01f21102c7904037e9c65bd3c85f43ee019fcc8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427235, "uuid": "0656ec3a-7a69-4cbb-aeeb-98482722cbf9", "comment": "Malware payload", "value": "2d779b630390b5143ea58cb8693a543eac2fcfcde63aea926e0a788302cf56dd9e489dda878e78d814ab28639dfb7255", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427235, "uuid": "efa44440-7ed4-4e97-827d-32cbbfb2cd23", "value": "CD249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427235, "uuid": "0143cf86-adb6-4edc-aa2a-95b1a27bfd2b", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427235, "uuid": "c64819a9-5cf4-43b8-8a89-3965e9852331", "value": "3072:N0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:QpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618427235, "uuid": "7c73d92e-d0c8-41d2-8541-f6422fe8caf5", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618427235, "uuid": "b6f97e9f-da5b-4908-add1-4eb0aadf757e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427235, "uuid": "93e10007-882b-4b15-9816-2756b5ea2d43", "value": "2e037edcb1e13e8b0289cf74510faa9d64528e4b29d7a493b078235c8db08f38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acedf91c-9d79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618443148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443148, "uuid": "e442c5cd-692d-4049-834f-a4a87fbf155b", "comment": "Malware payload", "value": "baae620859c033e8b1fa3102971bff7a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443148, "uuid": "a1a3dbe2-0d51-40e5-8f06-b00cc732d777", "comment": "Malware payload", "value": "2e0671194769538ef78567ff5a75876b522ffb10609bfc1487df3b48ea88dc96", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443148, "uuid": "6f1d45d9-5bb1-4214-85e8-72125b852f2b", "comment": "Malware payload", "value": "1d76f0efb3b8d2bfae7fe702e5a913af5b852d48", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443148, "uuid": "88a18f76-0c47-4b0f-94f0-30b9817f0002", "comment": "Malware payload", "value": "2ff98da511ae23436cc405c322487fa9ccc1ef7546f695ba520ac3a328d800c0b53ef5fa12ddb03bffc7218fdcef9387", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443148, "uuid": "1488a3ea-bd30-4852-8364-e588e34b5e59", "value": "4D249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443148, "uuid": "4ef78c24-757f-424f-a543-2efb23dacf1e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443148, "uuid": "e624840e-6dfd-4be3-b247-959a94868c12", "value": "3072:V0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:4pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618443148, "uuid": "b127fac4-1ee2-45d7-87c0-12d6517eee8a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618443148, "uuid": "cc5026ec-4000-456e-9fdc-079fbf8df05a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443148, "uuid": "860c82af-b209-487e-8910-5b6752b0a2bd", "value": "2e0671194769538ef78567ff5a75876b522ffb10609bfc1487df3b48ea88dc96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5d2494-9d7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618444170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444170, "uuid": "f5f36a7c-a9e7-4e02-a5ef-b95e1f4f314c", "comment": "Malware payload", "value": "134d5859373143d2794448176381e06d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444170, "uuid": "d64b8079-dfe8-48b0-842e-31b0a433869b", "comment": "Malware payload", "value": "2e23513572abc6c96944180072863e5aa2e39e5c98e5f4396c4c1bcd2185abf3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444170, "uuid": "d5ee87e0-dcee-4cba-86ef-51442f6379bb", "comment": "Malware payload", "value": "460c5fcf62bc7fb960602f14b6883044c41eb7bd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444170, "uuid": "76663de6-0d14-414f-8f76-ce67e61dcc1a", "comment": "Malware payload", "value": "f270d81af125d713dfba68f93904b34f09cf4b7ba41307549be3ce111469db772b37699ff8931f05c65e924a94b19933", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444170, "uuid": "e7f92f77-e3d5-431e-aebc-4a214acaacfd", "value": "17249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444170, "uuid": "d42fef19-dff6-4642-b9d7-3498186acc66", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444170, "uuid": "139c06ea-840e-4049-91ed-067e4a29d6aa", "value": "3072:z0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ypepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618444170, "uuid": "82c7996b-3511-46d5-bf72-b6ac565bf314", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618444170, "uuid": "f67bf056-1af6-4184-9ef9-f41241efe61d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444170, "uuid": "81389aa7-eb31-4909-ab4a-8fb9ec880b9d", "value": "2e23513572abc6c96944180072863e5aa2e39e5c98e5f4396c4c1bcd2185abf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a2f138-9cf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618384479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384479, "uuid": "4d3d4388-b063-4996-9956-9045fb94577e", "comment": "Malware payload (SnakeKeylogger)", "value": "3aaa0bd6ad9e231058ef998b9fb8e72c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384479, "uuid": "98e05f03-7eb0-4189-9501-d000bec4b377", "comment": "Malware payload (SnakeKeylogger)", "value": "2e5eabee7001e4a5adec24a18e680548ce354128edfdb10946fe4ee8a15b92cf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384479, "uuid": "eed37802-2d0b-4226-ad1c-b01501c699fb", "comment": "Malware payload (SnakeKeylogger)", "value": "dce4339db16d08ab502093b87d5607243a0264e4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384479, "uuid": "4aa41778-0b6a-4c57-8b0f-75bb5fe8add2", "comment": "Malware payload (SnakeKeylogger)", "value": "925d77a3e6ea7137401ddbaffdeacd81d70ce2274c389e96dccf71961f479d7493dd3962aa4721bf0d0343d0198a1bf4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384479, "uuid": "fcd17453-2d3c-41bc-bb40-d5007206c8d7", "value": "4E45CF90230E9581D9727E5E0F0AF59CE16BF62C98E09486F5AEE7FC17EE808D523447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384479, "uuid": "d433a6bf-bf2a-401f-97de-469e18f9b602", "value": "24576:tHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHvHdSOZH:tPPPPPPPPPPPPPPPPPPPPPPPPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618384479, "uuid": "445e3108-efff-4910-9fa8-1fad86a75973", "value": 1249045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618384479, "uuid": "3e406c73-8241-4651-8675-f4ab7bfea220", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384479, "uuid": "3b9e97c0-a606-4923-9be0-730338ba52a9", "value": "IMG_785_08_87.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72a4926-9d62-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618433260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433260, "uuid": "f8c363c3-35dd-4f82-9f23-d23bd671e9cc", "comment": "Malware payload", "value": "2432ca0a197a24ebc31f6a7f94f15a77", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433260, "uuid": "706398a3-f562-4206-9865-e3a10cad8453", "comment": "Malware payload", "value": "2fdedd1e99eb42bd23b0d6ae487750c5df3b2bfd86f333fc2f673006f2d83829", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433260, "uuid": "e572205c-5df8-436b-8550-f7f55bea7e99", "comment": "Malware payload", "value": "4dce2b76fc3e97981759dcd2b74c82a2956a86d7", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433260, "uuid": "89217deb-345a-49c3-8e34-09a968f136ca", "comment": "Malware payload", "value": "b771e43013f1dc3e1bc28504269b28a1f9f1206027d57e29dedd01ce4f8b477e6d2aad56be7006a3ba5a2a9e24b850dc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433260, "uuid": "a7fcaca7-a194-4827-b09a-516a9fdfa801", "value": "78F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433260, "uuid": "ee2ea0cc-e8c7-4fcc-80be-8a3270a7e41a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433260, "uuid": "8ed2dcd8-8ffb-4bd1-a8ae-89aa635afd86", "value": "3072:Rlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Rlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618433260, "uuid": "ee02cf92-a0e6-497d-92f7-89039abd7396", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618433260, "uuid": "6295edd8-618f-4612-83af-b3ab6c85ea5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433260, "uuid": "2c174143-5cc2-47dc-aaf7-9c3f92b94dfc", "value": "2fdedd1e99eb42bd23b0d6ae487750c5df3b2bfd86f333fc2f673006f2d83829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b176a5-9d76-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618441582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441582, "uuid": "dd862af9-3907-4781-afaa-cc648ea416e2", "comment": "Malware payload", "value": "a1ad52a39abee871d132f366ec09ed30", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441582, "uuid": "d9a944e5-a271-49bf-ad16-939deddcd1df", "comment": "Malware payload", "value": "305f6450a076d193425d5500a70a0c4b0bad096f3c0453ac47fc97b8b31d1038", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441582, "uuid": "4d8b8aa2-dffc-468b-bd5d-0c6edccac3ba", "comment": "Malware payload", "value": "8f4b62cdf0402c3ce5f049918244df5bb79078e7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441582, "uuid": "609e2f07-218f-45ee-aaeb-369e556ca49e", "comment": "Malware payload", "value": "a06435c77e70f104306268c8ecffb1d2a40205e31c8e04713466da416578f2c2db8bf79d418b6c46da5298a5cf74f1c1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441582, "uuid": "24763925-2dad-4e07-9fbb-0f15334eb036", "value": "4C249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441582, "uuid": "dea34440-9aa4-4425-917b-5546b98dceb4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441582, "uuid": "d81082bb-2730-43cb-bf6c-6b327cf53ae9", "value": "3072:J0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:8pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618441582, "uuid": "e9e0e010-c278-46fa-b31a-7f8ac50951f8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618441582, "uuid": "97bc7bd0-0d71-478a-9ccb-6159c757afaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441582, "uuid": "611b91d9-0383-4add-923b-bad391a9b73f", "value": "305f6450a076d193425d5500a70a0c4b0bad096f3c0453ac47fc97b8b31d1038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8f4a8d-9cf0-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618384442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384442, "uuid": "9f863f55-6ada-4eea-87e9-fad7b01eeb82", "comment": "Malware payload (RemcosRAT)", "value": "c589d8078ef698aa0b05fdbe324e7520", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384442, "uuid": "cefb9ca4-f4f6-43b5-bbc1-939a236fae8c", "comment": "Malware payload (RemcosRAT)", "value": "3070367628094bec21e5643057a992d9c6a3935b66d425d68cdfb2d070b91240", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384442, "uuid": "55ce1cb2-9494-4541-bcc1-ae89b675c2b2", "comment": "Malware payload (RemcosRAT)", "value": "dfdbd8800698285753c7b484988bb49560856805", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384442, "uuid": "cfb0d169-c601-49d8-9697-3178a6d9f8a7", "comment": "Malware payload (RemcosRAT)", "value": "2c1bae090992c7147a7e20aa3613ecc1792bdada69a698c4579bd1c89539bb6c636430932431d48b5d87fd332319fc81", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384442, "uuid": "c4a97a33-afe2-4e04-9add-100a92d946e1", "value": "1CE4F161695DFBABC85D07B1C05049B203B792A3E389DB9FEC9E10D50AD5782F61C2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384442, "uuid": "6fd5bfcb-3973-4840-9422-84d11436cb51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384442, "uuid": "f0dee71e-d823-41dc-877a-342c436ff866", "value": "12288:d1EV1pCoNXni6zl0CpF4OtSwfCqL5VRCCveVIntgH5q+Kb+NS:LipCoRi6zl00FZtSwaqL5nlveVHqhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618384442, "uuid": "42678f13-0bd7-4697-8173-17f706cb13bc", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618384442, "uuid": "e22e7b29-8802-4684-bd99-632768637f1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384442, "uuid": "64efc304-ba91-40fe-b5ba-2bdd5cbc8ba3", "value": "New Order QDT 206864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27aa23c-9d66-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435077, "uuid": "9063e06a-2e68-4858-9206-52cc4f8d1f61", "comment": "Malware payload", "value": "4cc5b999ceff0292c5b6ccdc7c7acbbc", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435077, "uuid": "44472763-7a94-4838-b72f-9b6f057e596c", "comment": "Malware payload", "value": "3091f15fdc3469bcf2d6af00f9c7a920356f8c405d48a2054291a93a1bb101d5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435077, "uuid": "0d7fc834-f5ec-444b-9718-2eb08be37133", "comment": "Malware payload", "value": "872e84241899755b643160b173d2a8eacd746b46", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435077, "uuid": "bd88b3b7-cf93-4015-9d88-13c1cfbfc08d", "comment": "Malware payload", "value": "a0b35fe6a25f0e2cd6c0bed31d2364f24d3a9fcc103bad2f3fac22b4b5be1f1dd71ea35de6ef7b179cf6915d92c042dd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435077, "uuid": "603aedc2-9682-46c5-af85-2b8e294b1f47", "value": "F7249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435077, "uuid": "69ee7835-5e9d-482f-88ea-f5eb3fc30c8c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435077, "uuid": "6059dd9f-3119-435b-ae86-7f73c2cfdcd0", "value": "3072:60DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ZpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435077, "uuid": "4d4d74be-c2c6-4982-935e-0d9cfa6fc192", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435077, "uuid": "de206dfe-0d6e-4a3c-97c5-056b9846866f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435077, "uuid": "93ab9cd9-14e3-41cc-b93a-aa75966ae517", "value": "3091f15fdc3469bcf2d6af00f9c7a920356f8c405d48a2054291a93a1bb101d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2059b7e2-9cf2-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1618384930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384930, "uuid": "5ede275c-53a7-4945-b2b9-6015b7ab14ae", "comment": "Malware payload (ZLoader)", "value": "dac52df1477fe8b567b656c1da2e876f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384930, "uuid": "c21005fb-ad97-44b3-bbe4-9dde42e78114", "comment": "Malware payload (ZLoader)", "value": "314ac0158727ba0bed95d244200e569e5aa9528f4c567c1c2c5cfba542fe545c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384930, "uuid": "c8119ddf-d01b-4520-be51-d60f1a0be1f3", "comment": "Malware payload (ZLoader)", "value": "4b020a24c3d68b21b586a531e04d558f04de4f52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384930, "uuid": "eb8b0cb2-9763-48cb-b727-e0605961efcd", "comment": "Malware payload (ZLoader)", "value": "b6ffea1763ac767a2f3686375bdd6a9923c62a3ad0a6a96a8b5118187daf2abc8708da6d85dc88f9cb3f5c4fe76b89f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384930, "uuid": "2d0e1b07-1b0f-4566-bbe5-2eeef7839e51", "value": "55E4AD247580C072C5A224358E65E5F9496DBC209F2156CB73DC3F7F6B306E1AA32A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384930, "uuid": "25b521ce-9404-435c-8cbf-9821b3160d79", "value": "1871ee680e7135cabc1e519d428eefe0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384930, "uuid": "736aa37a-e228-4877-9630-a9820478567b", "value": "12288:m9D8Diks/1k4R17DVu+PQYgzCNouGhKvuZkXSUxEMPEQIRAkwOBYSk8x3JVBKKZM:mG+kY9IYNouGiTxEnVdB7ku5VZrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618384930, "uuid": "2491017e-ee5c-4220-844e-3f4d0663803b", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618384930, "uuid": "0fed31b5-dcb6-49f3-b8ac-d8471b7fc2f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384930, "uuid": "f11b3e32-050d-43f8-8cc1-e99fed3f9f4b", "value": "2SoXN.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9740f66d-9cea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618381693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381693, "uuid": "13e6273b-a8e8-45a0-aa79-ef3127fdec2c", "comment": "Malware payload (Formbook)", "value": "19d3f981313e3737d0ef7ab22b3badcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381693, "uuid": "fff5219b-cf72-461c-abe3-e2672fed3a42", "comment": "Malware payload (Formbook)", "value": "3173946149373004e811a6c7ed1df43dda5cfdfaa4986c047560304eee748bcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381693, "uuid": "08731a7e-2f15-4751-bee2-bd779772d76e", "comment": "Malware payload (Formbook)", "value": "002c9423613ed22d1a1b3d97c67aeca16a02d9b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381693, "uuid": "54a30c32-1fa2-410f-ba9d-5ec49e44cb8c", "comment": "Malware payload (Formbook)", "value": "e1790704b6649537dc66c5cbebd02d6c88f834884ce25a1c6c5afe0ce02f7f4a2f20f1012385e42c486658dd48920329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381693, "uuid": "1eaf612c-0168-4cf0-aeae-4b65adef22f1", "value": "5F2501313BA8B756E47F623844A2048102F1FD116676CA5F7CE4B58D2BB2B52877372E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381693, "uuid": "2d88b0ec-de22-4d25-a242-b4312d1b13cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381693, "uuid": "9c28972a-b6a1-425c-b658-89e48999c984", "value": "24576:dmo5hiQa5XQliN7Oca7nG8K4BJDno5hrow579:dZ6AwJOcaq8hD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618381693, "uuid": "145df7c2-bcef-4f02-9fda-78f8e3c69887", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618381693, "uuid": "7f1b4dad-a793-4f5a-bf38-5ece84bbd1dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381693, "uuid": "194cb83e-ba5e-4cdc-9124-16a22e7d0be0", "value": "Swift Copy#0002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a8d17e-9d71-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439534, "uuid": "6d791706-2129-4035-8361-b7f9d90dbc3b", "comment": "Malware payload", "value": "2d048907a84a3b1275f676f7f74600a0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439534, "uuid": "b02971d9-28fa-4a15-b7a7-973e9108c50a", "comment": "Malware payload", "value": "322759b763858a854f45e21906a4fe64caa636a2481017af3b73099ea25ea1c4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439534, "uuid": "c5cce575-632b-4ced-8bbf-74e3d5a38fb8", "comment": "Malware payload", "value": "f00b1aca99a254ab7b3918c1181ec188801e30c0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439534, "uuid": "985a5698-1972-4c8a-a197-ab4ea70ec2f8", "comment": "Malware payload", "value": "b96db1b8f4e56407502005222ac15c9fcdd45bbc9fc6b1ecffe8a1eee586e3d36310977be939d893e4da2b7fabb8fd9a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439534, "uuid": "8ddc512f-84a1-4f0e-b40c-674bcc74838e", "value": "31F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439534, "uuid": "ce3c91f4-65b1-46c1-bb9a-97ac25242ea0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439534, "uuid": "9a4f2301-34e7-4a1e-b29a-5600102a2ac6", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439534, "uuid": "77be0301-83ef-4613-9b7b-3e42fd45a91e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439534, "uuid": "5c7cd582-6f99-4eda-b01f-fba5f3128716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439534, "uuid": "4a91a6d9-e2b6-4996-92c5-d5f573959aa9", "value": "322759b763858a854f45e21906a4fe64caa636a2481017af3b73099ea25ea1c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e21301f-9ce5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618379316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379316, "uuid": "4689cfcb-e655-4388-84b4-f25dfd9aac93", "comment": "Malware payload (AgentTesla)", "value": "e025d692276110efc2e32eef9313b162", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379316, "uuid": "e3099ded-e44e-4c32-b12c-66f04e469bd4", "comment": "Malware payload (AgentTesla)", "value": "325cc69b292b049784e205302186b2bb80d8ed53897fef477ce7f8b40ba50c6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379316, "uuid": "8cfb6c6e-dfad-45fa-972a-d09a9ed6ed03", "comment": "Malware payload (AgentTesla)", "value": "d3da943101b8065f70f078ddaf37d8c0cf8662e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379316, "uuid": "982d5c3a-a8a4-44ff-8e2d-98038695366a", "comment": "Malware payload (AgentTesla)", "value": "bb885c7cb2f9ee69b68f6b3817a269c72a736d3ab04a576783fd97fce021d320ed00271f74b3a869bf8724aa21b2a758", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379316, "uuid": "36dfffb8-c320-4bd4-b208-6f26f9d47172", "value": "D0E4231E3D9CDF24FC8BB4DC212D072D870ADB392DC7AB22A9D85B35679637C8011996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379316, "uuid": "7c58b63b-fe5e-4048-976c-2e2806c5a6be", "value": "12288:sjZNtqUc/VOL23yoVCcVh6rDHZJg5IZq1qZwq3K3db9qc/SfrA:s1NtqSbkCcCrDHESa3Bj/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379316, "uuid": "a15d5c15-db68-4566-b74e-2102463813dd", "value": 676827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379316, "uuid": "400f1a6c-fae9-4a37-b515-541dc7e85adc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379316, "uuid": "aa8cc40b-f95c-4bc6-a98d-75e0d67a87b9", "value": "RFQ____22701608.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3119ae3a-9d4a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618422754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422754, "uuid": "9558f561-a6b6-48ed-a88a-b4643a11d714", "comment": "Malware payload", "value": "e7335edf2192bb1856e7aadf2b6f7c33", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422754, "uuid": "1505cc65-60b1-448e-b29b-c6e5c219b7c1", "comment": "Malware payload", "value": "32dd6283937a4a3a926348d17b441616367c0c4184850ae73d6adfacedffc029", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422754, "uuid": "16be483f-e60c-417a-a7ea-13041aad720a", "comment": "Malware payload", "value": "5de854dc1ae077cefc7d08566fea95eba2b007be", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422754, "uuid": "34108523-ab7d-4a63-a1e4-e215a17a39cd", "comment": "Malware payload", "value": "4df950a00cacdddffca0477c2ade477f134375540d08ae369f176cab3e2ad1899bc06466a9650fdd04c4b1d7021521b6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422754, "uuid": "8ee6e95b-2f87-477c-b713-c8c80dce024c", "value": "F9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422754, "uuid": "9d31638c-3a41-4361-a658-05e5c17aa8d3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422754, "uuid": "8a626e3b-22be-47a9-9434-3922100eaae7", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618422754, "uuid": "e9719eee-a712-4e9b-ad7b-9d71d857f511", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618422754, "uuid": "e2c4f852-7648-4e6f-81b7-b99fca6fd492", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422754, "uuid": "8ef3b65d-c414-4801-b7ec-446fd0b772b9", "value": "32dd6283937a4a3a926348d17b441616367c0c4184850ae73d6adfacedffc029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28b76b3-9d3a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618416179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416179, "uuid": "bc934f05-1f25-4b94-b010-0ae0047edfa5", "comment": "Malware payload", "value": "73cf68ca6b8e5d22f354c52a33dfd3dd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416179, "uuid": "c9d04dca-3e5d-4b70-ab02-7e071d397bef", "comment": "Malware payload", "value": "339dab84c67fc5797f6d3e77db6460dcf1f11819ad5a4e21f6ee3ce15a859208", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416179, "uuid": "6d7ae15e-0dbf-4067-b1bd-0194c00b5799", "comment": "Malware payload", "value": "0614a10cc3e04a2242c21cc86901384fa8a799dd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416179, "uuid": "f26e1df3-6337-461b-b08f-4d0424962367", "comment": "Malware payload", "value": "4f764dd9da4526fa4e3abd3e52b429a53033e044e0cdc65f63bce14c809f0d34643bcb84650c7dd11bf1059281dc2ea1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416179, "uuid": "8e39ec7f-2f05-450e-9f1e-7652cf70a023", "value": "6D249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416179, "uuid": "40ff391c-e367-4b30-8d3a-737ae6294d5a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416179, "uuid": "149fffbe-244e-41a6-8710-c929722c4552", "value": "3072:l0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:opepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618416179, "uuid": "12716877-daf9-4559-9e82-49eb50905621", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618416179, "uuid": "09b3247d-6571-4b4c-bb52-62314838898f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416179, "uuid": "f418a41b-3d95-4346-b5d5-baf2ddd201bb", "value": "339dab84c67fc5797f6d3e77db6460dcf1f11819ad5a4e21f6ee3ce15a859208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02df3ec9-9d76-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618441574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441574, "uuid": "45c68380-1758-4181-8102-af01106f0214", "comment": "Malware payload", "value": "63aeef3b6ef10a66b31b5af057a109db", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441574, "uuid": "d6ab418a-fb7c-4ef4-a173-48be91428b77", "comment": "Malware payload", "value": "34bbbc74f88bb1da76a6e14a86a75155139e3da557906229c0daf4dc89e74a84", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441574, "uuid": "ee8b3e6c-70e6-4bc9-a8ea-123426648a3e", "comment": "Malware payload", "value": "16feba307bee9c28f5a4fca813e38f592d69377e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441574, "uuid": "32bfd0ed-542a-4424-99eb-98f164e75f68", "comment": "Malware payload", "value": "ffaa31fedba1625198efbd3a17d73bd4d07b3d8ca5d37a638aa11404b51207d65bbbb3036c1488658d9b5d6c933c3a73", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441574, "uuid": "041cd36d-b9ed-4c43-acde-300e180a44bc", "value": "A3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441574, "uuid": "93d07bac-efbe-4318-846e-adfab2c847de", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441574, "uuid": "94523819-43f1-4ebe-bfd7-19379ccc47d1", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618441574, "uuid": "eb7198b8-962a-4173-9773-855b210b4e62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618441574, "uuid": "963fe9de-6f2d-40e4-a8bd-81dc4b78ac5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441574, "uuid": "fa98320f-b64c-40da-8fec-f937fc2115fc", "value": "34bbbc74f88bb1da76a6e14a86a75155139e3da557906229c0daf4dc89e74a84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee8ec8a-9d53-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426562, "uuid": "f0786b14-cf02-4f3e-8f69-1c5b57a80698", "comment": "Malware payload", "value": "6836e2cd54c2439663109b87b8a80496", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426562, "uuid": "6c015abf-3671-4bce-a5f4-53826d35add0", "comment": "Malware payload", "value": "3532cef17bbeb274ed57361501be18f57bc02dc8662c5deabb906a3f758bb30f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426562, "uuid": "e42033b1-6287-4769-ba4b-c128d50bdffb", "comment": "Malware payload", "value": "91c7c25c93cfe6b660c83284a76a2a50c8424eea", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426562, "uuid": "f6d8f0a5-e2ee-4474-9fc0-a89af0f50124", "comment": "Malware payload", "value": "fc0519195c212d495aabdc38a0ba9fce3b67520334be72c435aa38224399d1c342baf374365d4b3f12506cf38fc7ee74", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426562, "uuid": "3b734424-1e00-43bd-930f-f74cb0d82a56", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426562, "uuid": "233ee3b5-692b-4161-ac42-81d5a717023e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426562, "uuid": "e63cc6dc-47a2-4ed4-be8d-886a68737ff2", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426562, "uuid": "b88c9d39-5012-4912-a038-baa6ab4a0d94", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426562, "uuid": "e4221a62-f82f-43a5-9648-b3b33eab71de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426562, "uuid": "ad5aa53b-b26e-4f7b-a55a-89e85f62df3e", "value": "3532cef17bbeb274ed57361501be18f57bc02dc8662c5deabb906a3f758bb30f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb534cb-9ce8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618380979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380979, "uuid": "71a778ea-59b1-4102-aa32-af7dfc949d37", "comment": "Malware payload (AgentTesla)", "value": "a75758928fba46a121aed0efe9b04514", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380979, "uuid": "7e8094fd-bfcc-4991-9ec1-ad3bcf7bfd48", "comment": "Malware payload (AgentTesla)", "value": "36905789a77408711c73e386496f582d8e7d7e3c348200c51f6e6ee10ad7fe98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380979, "uuid": "fe024d21-fa5f-4dc7-a534-dcd4d45779d1", "comment": "Malware payload (AgentTesla)", "value": "3efb2356fc5b2cd4cc43ea41c16968a8c54a6729", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380979, "uuid": "ada6fc28-aeb1-452b-9891-a02e561b9330", "comment": "Malware payload (AgentTesla)", "value": "ee81456415f13b4c55650b8e73ddd4700e14717cbd57a58c2adfaae0c04f408465b7f9a3ac34b3efe8fd722a351d297e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380979, "uuid": "beec41cc-ad72-46f4-b787-c2316665e785", "value": "FE15AE0167C6AF45E33E4F339CE6A0208BF9D4073E5AD78B1EC914D955B8F218A65E0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380979, "uuid": "8add2c56-7470-4def-a8a3-69f6891a9d2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380979, "uuid": "0e2a0aee-532e-4f77-bd6a-f7b4acaa8307", "value": "12288:LsGVgEByHEzeZbnioqee7Q7q5V11tnDSfhtHKr4:nVvmFemQf15mZtqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618380979, "uuid": "8d4114ea-9610-4713-b9f9-62f3258be147", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618380979, "uuid": "909b3741-436e-4a9d-b3a8-d09fdf823fbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380979, "uuid": "dd015a9d-83d4-473e-966c-4ab5b82922d8", "value": "outstanding invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c413b416-9d7b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618444046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444046, "uuid": "6c321de5-5aa8-4521-83f6-8109e6f69be1", "comment": "Malware payload", "value": "6e3a9bf562b6d50aabbdd8b3f8970767", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444046, "uuid": "5fd20749-78ab-40ec-bec0-6ad77238a4c2", "comment": "Malware payload", "value": "370db0be254d519052d889ada4eb81ce5811413726792c3fa175c70fa17855f4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444046, "uuid": "797b773e-ebdc-4434-9a3f-8f41ae183db8", "comment": "Malware payload", "value": "9a30f94418679985f416161d4ef8b5ff64e7cb43", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444046, "uuid": "507d61e0-7e81-4d40-9775-28a01bedb3fc", "comment": "Malware payload", "value": "229398cde91f09c6b4eaf8e91575dea9ddd66cf8e11f07a02c39a55fa615f27db29051e5d1a40bfe66f06e0970556f13", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444046, "uuid": "5fce20d8-f14e-4a85-a5ac-cdd16d00a370", "value": "B7249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444046, "uuid": "dc903014-6785-4495-8563-b459a9b6c939", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444046, "uuid": "199bd319-1779-463d-a0c4-237e404d0bbb", "value": "3072:z0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ypepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618444046, "uuid": "d75d3d36-bcd2-45c7-8ab3-346a36e0873d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618444046, "uuid": "624229ae-38fd-422b-bc14-6bdb48411a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444046, "uuid": "07cd5071-1e9d-4415-b62a-711b2dfaf3d7", "value": "370db0be254d519052d889ada4eb81ce5811413726792c3fa175c70fa17855f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf5ff5b-9cc5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1618365921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618365921, "uuid": "64e5288b-d882-4043-8d22-eb71df35f24e", "comment": "Malware payload (Amadey)", "value": "92ece8f284c4ce928877ec8352206284", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618365921, "uuid": "48c1d3b3-4611-4e4f-a605-34572a118955", "comment": "Malware payload (Amadey)", "value": "37ad471d4b3ea1644bb111bacdf6306189214c900ee8882c3b85cab7d5a67351", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618365921, "uuid": "6d438667-e087-434a-9f73-86b3275429aa", "comment": "Malware payload (Amadey)", "value": "8386f3af52aa8505d1e668dc7bfecf48c37e8387", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618365921, "uuid": "ff7ce74f-d012-4c7f-926a-37b1592cb42f", "comment": "Malware payload (Amadey)", "value": "15ecf2e85d5850d24db2784502f1b241184ad676d430a30a67ac7b89e9f7dc31ac32441f4b224e7c317da1955a73175f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618365921, "uuid": "2ec0c681-7bc3-45b1-b282-d68db98728be", "value": "0B44E1237BB40C62E62705F10FE1D7751B35FC66C6528E0B2285799D1EB2B82ADD132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618365921, "uuid": "e87433b9-0145-418c-9720-343df67d19f7", "value": "5806337127c1779eba2317d8ff379a05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618365921, "uuid": "01b28890-8ba9-43d6-9715-1aa70668fe61", "value": "3072:9We26CvCXCHpVQH0/5WDD6Z6TEOq5G9/5CZzJaxAjZJssQRFSUR5D5ZrYaE3YXpN:kpVJ5WDD6w3j9ONaxyCuURdnYwg8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618365921, "uuid": "7a88b732-adc7-4477-b8b9-d831d4aad789", "value": 271392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618365921, "uuid": "4c46f92d-0f52-4e28-a4ad-fca239049237", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618365921, "uuid": "97f476b9-ab81-451c-b376-74c5a0ff16b4", "value": "92ece8f284c4ce928877ec8352206284.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74083cb1-9d6b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618437039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437039, "uuid": "f15ef4fb-9550-4700-a58a-2d9b6e449e9f", "comment": "Malware payload", "value": "c0997bb0b97bdd5c3ac780bf305c69a9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437039, "uuid": "cbcf79a8-9a84-44f6-86d7-968750f6d751", "comment": "Malware payload", "value": "37edbbe59dfc621f0c8b2e9d294060735677d9b7e7844c7cee9f7fea47174b3e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437039, "uuid": "620f8f6e-1096-4d3c-8c70-3d5f5fa7ef16", "comment": "Malware payload", "value": "ab7e22e3f499d7d19490efa10f2391847e66e2c7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437039, "uuid": "36ef6d5a-6d67-46a5-bc95-eb6d7d9398ee", "comment": "Malware payload", "value": "0b641fd5dca8e820fad0d8446186178c2075e709800489cf3e34fdf0df7d1fa6589ee5cbc554897327d673672be6d767", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437039, "uuid": "f77ff1ee-8bc6-496f-9507-046bb88746b4", "value": "7A249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437039, "uuid": "4cf2bc28-69f6-47e6-8838-0494b1229e99", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437039, "uuid": "81fb1c70-3d70-41f1-8093-7dcde4982762", "value": "3072:40DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:TpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618437039, "uuid": "ce27fd42-5367-4cd1-9720-cd7de3ae8de5", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618437039, "uuid": "8cb04d85-6997-4f42-a08b-c5067809ac92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437039, "uuid": "1b095eac-a1be-48d1-8978-5c72ef2987eb", "value": "37edbbe59dfc621f0c8b2e9d294060735677d9b7e7844c7cee9f7fea47174b3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f81036d-9d5d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430858, "uuid": "4bc9aeb9-fc98-42e8-bb26-44bd8c339925", "comment": "Malware payload", "value": "7fb3cdb7c06a8fcfb5bd9a91f34b2f62", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430858, "uuid": "1facc283-80ed-44d3-9b60-0b7313af57cc", "comment": "Malware payload", "value": "388ea8f5e1581646b2658a7b542b313e822a9413b1e2f6f9e4222c3b3e7e41e1", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430858, "uuid": "6545f190-51a9-44c6-90da-780ddc331d88", "comment": "Malware payload", "value": "7487ff3414ffb8c6a921785f5f28c546a77923ef", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430858, "uuid": "0483579e-1b43-4913-b553-15ff141ad0c7", "comment": "Malware payload", "value": "e00e31ba3e719d86909717ddfc0b855a81b363d3cf8e0fd4a1f9c009bf5e2f6f05c32b3ab8c6dd6af7d168135f99d873", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430858, "uuid": "9447ac6a-7a03-455d-b2a0-abaf40f6bcfd", "value": "01F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430858, "uuid": "71d12ff2-165e-405c-b9e0-515e394dd919", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430858, "uuid": "c9a1f744-6580-4f55-909f-cbd717fc95eb", "value": "3072:tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430858, "uuid": "05876fda-0a34-4717-9915-04a7e1a54ccd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430858, "uuid": "315f4ffa-128a-4f21-8394-17dbf7b3453d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430858, "uuid": "f6601f0d-130e-4c52-a461-6a03369ca625", "value": "388ea8f5e1581646b2658a7b542b313e822a9413b1e2f6f9e4222c3b3e7e41e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c7e75b-9d6c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618437660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437660, "uuid": "35747f6f-3e32-48c3-ac21-cfd0b065deb2", "comment": "Malware payload", "value": "7257206b087061885b83ea439c554dd0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437660, "uuid": "fe4b182c-76cb-4fc2-89a2-c365d7f00784", "comment": "Malware payload", "value": "392fee4d7e3b58775a26e61e9b7ebb5aac900a9d3ab053ba2b49cb0e6114c731", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437660, "uuid": "7415f903-72b9-430e-82d4-136fe95b365e", "comment": "Malware payload", "value": "c3e29f538849ce1eb5c36cc6e8fbdc6bc7089c64", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437660, "uuid": "af8e0387-817d-4c98-91bc-33364b890abc", "comment": "Malware payload", "value": "0d77fd97eb1a1320cacc0a04c2643374387ec01d2455f84dc2f04a4aae87cc62b47be9b75a8366a08917a970b5089d6c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437660, "uuid": "85c5a9aa-5638-4e2a-9095-e12f0dd55ade", "value": "57249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437660, "uuid": "21fc32ef-b1e8-4dfc-8b4c-ab179357a9a4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437660, "uuid": "182d3259-3475-46ed-ad3c-38f78839f237", "value": "3072:O0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:NpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618437660, "uuid": "e18af5f1-a66b-4341-bf93-d7c952358753", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618437660, "uuid": "83073abe-7d54-43d2-a24f-697b54e68158", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437660, "uuid": "79851736-c0fc-4e78-9af8-6c356c7eb642", "value": "392fee4d7e3b58775a26e61e9b7ebb5aac900a9d3ab053ba2b49cb0e6114c731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33e1984-9d61-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432824, "uuid": "eea922e8-707e-48d5-9669-00d084bbbb61", "comment": "Malware payload", "value": "556f400e2e8111b1f3ccb6b9c76380e2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432824, "uuid": "167e9a56-c567-4fd0-838b-5e41e011bd50", "comment": "Malware payload", "value": "3a660fbfbd39a34d940309ef783bd97ea6cd680f06ec9037bc8411c2973057cb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432824, "uuid": "6f42ba9c-24d3-4991-8e4d-af3c6c35dbb5", "comment": "Malware payload", "value": "a43c835727971da88bfbb0fd3c3f755909d610c5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432824, "uuid": "5434eec4-0f43-4b1a-b177-0ab4cbcc4f76", "comment": "Malware payload", "value": "412c63596aecaa4225ff877200a1264e4df116318cb9d19cac59748f03a0b1727eccda820b1c5c974ddd76e15dfa81a6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432824, "uuid": "3a694968-ef5f-4b9f-926c-a4357530db4b", "value": "BC249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432824, "uuid": "afa1bdcb-a8ce-4de4-b730-4cd058ba264a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432824, "uuid": "bf526d55-ef15-4c67-806f-72ac2d54a05f", "value": "3072:x0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:kpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432824, "uuid": "a0410564-3476-44c1-a3b4-171cac8746d1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432824, "uuid": "cefb9ba3-be5a-4425-a1dc-1e45b903df57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432824, "uuid": "86623297-1d18-4411-91cf-a41532b3c6fe", "value": "3a660fbfbd39a34d940309ef783bd97ea6cd680f06ec9037bc8411c2973057cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1528330-9d70-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439343, "uuid": "8c38a70f-0e04-4983-b89e-69aa410ca1ec", "comment": "Malware payload", "value": "96b1dd55030e6d50ba4481e40824191f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439343, "uuid": "33ae0daa-833a-4c53-889b-41fedc3a518b", "comment": "Malware payload", "value": "3a79d7a7be0f8b06438ed5cb5bb7891d6f59716367e13f1959fb9cf4cb362d41", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439343, "uuid": "46f207cf-d15d-4d73-8704-4f2259da8dae", "comment": "Malware payload", "value": "83df397c1950ae9bf7b6f689f626f5bbb831d4e9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439343, "uuid": "576b9757-2083-481a-b648-fce079165d77", "comment": "Malware payload", "value": "72f2df5b3d7530cc78a9d6b845c856bd14f0652e8cff99a17ae4416cf8a8135cc9a711e138af142081e31b891d4443cf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439343, "uuid": "324e1ecd-baec-443b-b02f-f51cdace16c3", "value": "A4249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439343, "uuid": "70266595-8b42-4208-a90a-3634b1ccbfc9", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439343, "uuid": "9234ad5b-273e-4d41-b2d7-cf52a57f7927", "value": "3072:x0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:kpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439343, "uuid": "fb481164-1c82-4450-876c-ca297faf0c24", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439343, "uuid": "19acb5f5-db8f-4590-8293-6c0158a6094a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439343, "uuid": "6d4b3054-5438-4c58-a869-4a26365f816b", "value": "3a79d7a7be0f8b06438ed5cb5bb7891d6f59716367e13f1959fb9cf4cb362d41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d424008a-9d4d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424316, "uuid": "65b493ac-5e54-4328-9679-f5e14da44c12", "comment": "Malware payload", "value": "555960d83c9ee5c8c5ae953a289fae48", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424316, "uuid": "e53171d3-d22a-483a-b492-758d0c5ddc16", "comment": "Malware payload", "value": "3c48f9df4ee27e90d9fb24cf08fccf4ec30a0f38fd777c008ad81b2c5385adb7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424316, "uuid": "618513bb-f93a-480a-92e4-4bc6954f8566", "comment": "Malware payload", "value": "1878e5711cb8796b3d41e592bc41244c0b847b31", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424316, "uuid": "34acf61c-87c8-4562-af0d-5455f0ba07c1", "comment": "Malware payload", "value": "f661fd0607d938cad92fd9e66bf1e267daa145795c9133edb5afa7923822ea2fa5506a0987db2f8f177a1f3de7a6a1fd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424316, "uuid": "dabc5eb3-5bb9-48d0-baa3-44658fa3b02e", "value": "EBF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424316, "uuid": "17e1264b-bb6c-4e85-a2db-0a0ee02c5640", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424316, "uuid": "cdacaa95-c1bf-4854-9bdc-6741aaa668c8", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424316, "uuid": "8d822831-2a05-4b98-a43b-a72a899715d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424316, "uuid": "218b19ef-df57-4db3-a09b-e3d9b16f6cc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424316, "uuid": "8a5e6f51-7388-49b4-b749-220c89aeefc3", "value": "3c48f9df4ee27e90d9fb24cf08fccf4ec30a0f38fd777c008ad81b2c5385adb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cd8e4f-9ce2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618378181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378181, "uuid": "f76a7bd2-7af6-44f1-bea6-0ee9aa70ae1a", "comment": "Malware payload (Formbook)", "value": "1ba7514dbea0f4317acc2aa30e2a0b98", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378181, "uuid": "fa85e700-518c-4873-903f-a48189c36064", "comment": "Malware payload (Formbook)", "value": "3e43a0c193bbd78bf18e1a9e06b06c647039bae68764b81703cede03b6dbf181", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378181, "uuid": "fde7b36b-6337-44ad-8dab-1cf34f0cb747", "comment": "Malware payload (Formbook)", "value": "1e868b4ba7008d9d1997894df9198836264893a8", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378181, "uuid": "59b57181-90f1-4ece-bfa2-6a2a6072ca01", "comment": "Malware payload (Formbook)", "value": "da5fc0b634d94cfeb78fd8b9a1b9b2054651aac5a0609c927d745b4bc3d26d028080e205f9ca52a82a243174b2cccea2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378181, "uuid": "f5248c59-6896-4403-b7d1-b1178ea114a9", "value": "492423FBCC850EB0A765EC94DF06938D03450F90629E7BECC1CA91AEA4F4DDE02625B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378181, "uuid": "1ebf214f-3129-4440-87f7-aae5eb7da395", "value": "6144:AeW3twf563naIFLoHo+F0tTTUpyrIbaF6b8LIl5d:AVOkqIFLox01g0reaF6t5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618378181, "uuid": "d74a3a25-7c81-41a4-aa9a-efa45164cd15", "value": 214944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618378181, "uuid": "f0c5d11e-3230-459c-95eb-e3884e7c8780", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378181, "uuid": "4b685a49-285a-43f8-9697-bcd40f82ef0a", "value": "SWIFT COPY_PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36a85ff-9cef-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1618383915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383915, "uuid": "9e9df2c0-c713-467d-b9db-79800cce4432", "comment": "Malware payload (NetWire)", "value": "e68cea2c0c38458cb6828b2642adbdcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383915, "uuid": "e085b450-4354-44e1-ab85-3c26596ca3cb", "comment": "Malware payload (NetWire)", "value": "3e4d51c93e584902549b54e3b22595a4f78a87a9eb4648be7af3b5cc6a682078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383915, "uuid": "08c5e2c4-3d50-4e3e-8132-12715eec2e4a", "comment": "Malware payload (NetWire)", "value": "6003223db95be128db6bcfa435658767b1bf3faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383915, "uuid": "8c7b65e2-20bd-4426-a59d-6eb740975e76", "comment": "Malware payload (NetWire)", "value": "53bce134eca3aac501e560a2a2f5a2dfeec68f81aaf8662dece0dd3daeff28e8d74c4e8e328badc890dc2d2e35801499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383915, "uuid": "ea5b76a2-28fd-4281-8462-455925424ac8", "value": "6094F1163B9EFECEC1A409B10A7685931E24FD160A46A36BB1B0BB257476363390DD37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383915, "uuid": "3cbdddcd-5a6e-4285-89fd-ed829fa78b7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383915, "uuid": "0bbc4cdc-8aba-4211-bb6f-c258428f8c48", "value": "6144:YhIqsdVGRRI0cIYCljXYfy0l3jWaurtBBYSCKbbS0sb2ocg0Uew1e:YhIjcuOlXYfy0lSHBYnKsbogve6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618383915, "uuid": "3e4f182c-a304-4bde-8b0e-b7d11cbb3469", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618383915, "uuid": "f28d01ac-64f0-4526-a3cf-f8db7e7df704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383915, "uuid": "01850301-895a-41e9-ac80-af377f99fa99", "value": "GT42536.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0d59b1-9cec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618382396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382396, "uuid": "f36874af-47c5-4928-9633-33807f0e0938", "comment": "Malware payload", "value": "8a74ed322e5f3760a3630f6f602eb851", "object_relation": "md5", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382396, "uuid": "0cd8927d-79e3-4c77-9a19-5e5795b645a8", "comment": "Malware payload", "value": "3e4ecb092acec8de4f0f1a76e3029f4b3c4496e271dbde23413362d320405c24", "object_relation": "sha256", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382396, "uuid": "6d1b305f-e294-42d5-b059-ff6c7191a9ab", "comment": "Malware payload", "value": "ad0c60a61d3edfb7730a353ef0d2028dbb5cf31f", "object_relation": "sha1", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382396, "uuid": "7b1718e6-e797-467b-a7d1-0de2dd9b11fb", "comment": "Malware payload", "value": "d2ad73f30ec29dcebc7b71b4d609ffcfded30dabe9ad0b7ba910dc2881c9ba0b6c382ef48a6f9d2328395240b81675c2", "object_relation": "sha3-384", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382396, "uuid": "37a02be2-f910-4d52-97f5-5c1a99d8313e", "value": "211533C86F811154AC29C0619462BC95952CF8CA6AC73B7D62033FBB3B6F18578527BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382396, "uuid": "8d6c7c0c-a47e-4a36-b1a8-385dc81ed8ef", "value": "24576:0rc1zo8Ama1NDpLOe/6DRhMb21ZBFkq6dcSz:yio8Ama/pie/6DRhMC3BF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618382396, "uuid": "ad4232d8-a83b-4a38-97c6-02a0f0ad2e0d", "value": 905680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618382396, "uuid": "6e1fe0de-be77-4393-a150-b150ab3be9ef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382396, "uuid": "38401037-13ad-48ca-a7a0-935adb876bb5", "value": "00909000870.R12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1defe604-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424869, "uuid": "f7eb3bd6-0a40-4577-a23e-b027cb139677", "comment": "Malware payload", "value": "28a60a134cda7dc04c3d29734ff11e05", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424869, "uuid": "0f2def3c-6b22-4f27-b47b-3c005cae0d93", "comment": "Malware payload", "value": "3e770f39eaa5c35ae0755b58242a3520755a659a7befae000da623c507ca7949", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424869, "uuid": "46ecbc82-72bc-43e3-955c-0c0b6d9d77ad", "comment": "Malware payload", "value": "ff7d1e2001d98fc2d0c70dc327cfe765ab17369c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424869, "uuid": "bb916a13-6626-43a4-ab18-7b4366bad299", "comment": "Malware payload", "value": "42a2abe4906a0ac868b5c90af2239fa21471c4eb2c4e7b8cee1b33f5566125d668c19495c1939799903b7130cc8546fa", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424869, "uuid": "d5b132cf-76ea-4c79-b0f5-cd4b31efaf07", "value": "A2249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424869, "uuid": "8faefff9-98df-4950-b628-8026b921e3e8", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424869, "uuid": "12f1f44a-d3b1-47c7-b82a-7dce88d15683", "value": "3072:B0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:UpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424869, "uuid": "81096af2-1498-44d9-8d49-bce3fb00eae3", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424869, "uuid": "b9eb2d2f-6af7-4d07-a93d-fba9d3ccaed2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424869, "uuid": "f8c04061-98ea-4597-995a-69ebe467c456", "value": "3e770f39eaa5c35ae0755b58242a3520755a659a7befae000da623c507ca7949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29745e42-9ceb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618381939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381939, "uuid": "37dcc055-d6b4-4d13-877a-303139d06d30", "comment": "Malware payload (Loki)", "value": "606f8c500d29b0a76a1a7d84fd64a1c7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381939, "uuid": "04f52946-d1c9-4ebc-b8f5-30fb627fd8ea", "comment": "Malware payload (Loki)", "value": "3ea7ebf6c3a1c5a6775044f36d1cda98ce6d92e14232b20aa11a395338eb007d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381939, "uuid": "18d4e0ae-06c2-4223-bdf4-e7b53f4a206f", "comment": "Malware payload (Loki)", "value": "4222ce2f890164f321385b07ec25d13c9323f3a7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381939, "uuid": "fcede15b-9dc4-452c-9141-d0460d854a12", "comment": "Malware payload (Loki)", "value": "62aec68f003fc8405d9dcbf1fc60201d0686e7b1bb753b4e84d4034191d171bf31df3db2ed3348c24bd150c6261325f1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381939, "uuid": "90950f6d-c0b8-4d3b-83d1-4f23929e60fa", "value": "3284BE106AACFB99D46D2BB2D861593113B3621BE31ACB1FDC8D10CD4DB4742F8687A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381939, "uuid": "5be568be-cc02-49fa-9709-b5aa153c02bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381939, "uuid": "e719ae1b-960e-4c44-93e1-ac37ce061cb1", "value": "6144:OpdKfRVbjsv9cqlEJJw0DQrDPmcXp4c4IS6yGllE7o1C/enLzQq1WTwkQ:OFlEJJw0DQrDPmc54c46yGLHCnq1ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618381939, "uuid": "92e5fa9e-cb2c-4d37-a905-e62f78cf262a", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618381939, "uuid": "1a094894-2a0e-4974-9a8c-f4bd272bf6ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381939, "uuid": "8f8a1ebd-8131-4ed3-84b5-f479227bb548", "value": "Po___20211404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b663e03-9d6c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618437508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437508, "uuid": "58fd29a1-ab5f-4ccc-83cb-f55146eb32aa", "comment": "Malware payload", "value": "b02ac3684e19c9b9a23ed5621f8b0577", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437508, "uuid": "9537b2f4-a431-45be-892b-ef145f16149c", "comment": "Malware payload", "value": "3ed2a64cf4087f0f9564483a6923e8795297e62abc579ea1f097bc14c6bfb23c", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437508, "uuid": "ec84dc7c-12f1-4c38-89fb-1791646fae96", "comment": "Malware payload", "value": "32d108d4c3a00c72abfb0062e05789e882dc2d95", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437508, "uuid": "0195b602-3c87-4906-abc0-c2b5fbbb9608", "comment": "Malware payload", "value": "091d4a64adcb31c39d3ac019883e34d090e8254c3333196ac0c69018e529e2a76b625b9f3b097b3a0eeefa4feedf1acc", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437508, "uuid": "d5ed2ff3-a0a2-4485-b572-e8e9dc35c408", "value": "24F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437508, "uuid": "e711606f-bfb7-49cd-a11c-196b483d95cb", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437508, "uuid": "8e4a1228-b8da-4c57-afaf-d6b83c35d3ff", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618437508, "uuid": "6a691b54-8db6-4540-b664-b97158930c42", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618437508, "uuid": "1deb0c84-8f9d-4861-bf26-be8aa0958851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437508, "uuid": "bda37bfc-45eb-4827-a223-7ac2cf8a9ccc", "value": "3ed2a64cf4087f0f9564483a6923e8795297e62abc579ea1f097bc14c6bfb23c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a526076-9d6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618438768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438768, "uuid": "684d416a-cf74-459c-b210-68c75bf98cc0", "comment": "Malware payload", "value": "3f4537a934b3220177cf1158f139a3da", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438768, "uuid": "f59584c5-1cf7-4432-953a-85fc32eee22b", "comment": "Malware payload", "value": "3edac16f5434b863f9936e99ba2ef8607924e4d87648c65b487fb06e05ed1816", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438768, "uuid": "fd93ad79-9b19-487a-88af-05a2fae07ce4", "comment": "Malware payload", "value": "9af6bf661bdeeff37cdc0e867ea2d0039ab6376f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438768, "uuid": "4aa78a2d-f0c1-4fdf-8f11-d942a8f6dee2", "comment": "Malware payload", "value": "38832f14d5b29014106e2ced86fdc082084f3313dcaf769ed8fce0e62842ee7ffe2dd494f8aeb2d7804c40ee0edc838d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438768, "uuid": "a635457b-94b9-41aa-8d0e-00a00b6bb4a5", "value": "AA249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438768, "uuid": "532a2f8c-d7fc-4dda-a5f3-f6da902c716e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438768, "uuid": "91e2eb67-6e2d-45c5-9378-b350946f7969", "value": "3072:t0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:wpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618438768, "uuid": "6b7c5cdb-f435-47ec-950f-ccdc9eb229d7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618438768, "uuid": "c45f9533-f2eb-48ce-b7ce-c9628eb95c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438768, "uuid": "743cfea3-1144-4fb0-920a-61f8ccffef4c", "value": "3edac16f5434b863f9936e99ba2ef8607924e4d87648c65b487fb06e05ed1816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57bf47e5-9d67-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435274, "uuid": "f73caf1e-d4b2-43b4-8ac0-3f353ee2606f", "comment": "Malware payload", "value": "198b7ccce6479e1f73aa078216419b26", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435274, "uuid": "477380e3-e181-4320-87ef-218c543f5706", "comment": "Malware payload", "value": "40871ece9f4b5e82784652d014c11acf76a7cd19431f0cc902390a8a0f31e1df", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435274, "uuid": "3601dac1-356c-4141-97b0-4185bc9f657c", "comment": "Malware payload", "value": "f4c54dbf04c79c3d5f30a9a44edefea430818b3e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435274, "uuid": "3d8402af-ebd6-4a08-aea0-6db9d3cca09b", "comment": "Malware payload", "value": "7a5dfe0f6cd1c580a936be9c02c49336c07853238e54d78de7d5fe7fd0bf36d272c2671baedc2abab4d871184f847612", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435274, "uuid": "e9c7da37-8214-4690-8c19-f83988f67fa5", "value": "59F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435274, "uuid": "cd66257c-ec37-4558-9f4f-091f35194ff5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435274, "uuid": "620125a5-ad6a-41fb-ae5d-7ca000d3a20a", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435274, "uuid": "e86529e8-1498-452a-b978-3332b4d0a5a8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435274, "uuid": "6998e5bc-c5ce-4c88-8d68-8b1ea76495a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435274, "uuid": "20592829-f64e-4a2d-9feb-2331593a6bb7", "value": "40871ece9f4b5e82784652d014c11acf76a7cd19431f0cc902390a8a0f31e1df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474d1dde-9d50-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425368, "uuid": "f23b69ae-6ec0-4051-a98f-a092218da972", "comment": "Malware payload", "value": "d52e2a012af5c07a04750f9afd837f6b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425368, "uuid": "b0551089-4036-4272-b387-530c8ced444d", "comment": "Malware payload", "value": "40c24c9db30fb9576c068e8ba344a31de97ed75448354c910f40a7ad38ab5850", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425368, "uuid": "c17e07b6-87e0-4b0a-a39d-93e1df092fe9", "comment": "Malware payload", "value": "fd110cd83cd65e3499ea75d41b259303fdb2200c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425368, "uuid": "baacca84-3051-4cb0-ad3d-21db85605b37", "comment": "Malware payload", "value": "09327f6d28cf1a97b52ba77c4d0b3a6a65373eefebbe8d66513be1fd66487288bdc089af8b9952db844b95cb40466be2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425368, "uuid": "ec432fec-ed81-431e-a730-c23eb335d3cb", "value": "AF057D32B1804473D0AF1E789D1BB3B95C26FD012EE4948A7BF4ED8C6E397907935296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425368, "uuid": "3e69a10e-158f-4e77-bbc1-2b6df9784353", "value": "8eb92c7c13cef2a847615f9075a14c7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425368, "uuid": "46b28045-b48a-4ecf-a03c-726efef967df", "value": "12288:9eLF/H+uJFLVETZPhyV9j5RfOWlW/o3auG+H9iaU/OyV:YLFf+iVETZPULzGWACafqUDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425368, "uuid": "d966e80c-1f90-400b-8a6f-602fa2862cdf", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425368, "uuid": "af772f3f-6ba7-4b82-a425-a326e4a46a13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425368, "uuid": "d194f29a-151e-498a-80ed-12d60a4093e8", "value": "Urgente RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5fb906-9d5b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430128, "uuid": "af085185-db62-46c0-820d-cae1954ecebf", "comment": "Malware payload", "value": "fd2b75728280e5e0fc939e5ed7577632", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430128, "uuid": "3203cce0-d328-488d-be1d-c751eb4e3a41", "comment": "Malware payload", "value": "4143e1ac1cd5ad1305476a77c8b4e1c4a39b0b35b04effc94daebc3db94bb91a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430128, "uuid": "de533f39-7570-445c-ad2a-3b76561cd2b2", "comment": "Malware payload", "value": "e7506f069f3318ca9a9474d006e73acc63756598", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430128, "uuid": "802412fd-3ae3-45de-853e-65bdb9feef32", "comment": "Malware payload", "value": "30c8fe125274daecfe83a2202d7876eec93645de1bd0569f3cff4190a40a032deb043d48efe63d424e7eb16a92a30196", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430128, "uuid": "1046d7e6-f5bf-4186-8bcb-b59d00ab7d95", "value": "91F3D088CBB3E4E6EFB3D37866F85E1B4A1174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430128, "uuid": "7f6ee99b-2ce7-44c3-9759-67f0705855bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430128, "uuid": "cd4dab77-45de-409f-9159-4745adb73031", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430128, "uuid": "29c4174d-9488-4103-b31a-876741772ea5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430128, "uuid": "4d860d5b-a34b-4925-9f03-d5d8293b1f5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430128, "uuid": "f6636ac8-bece-4bef-9df2-ac5c61660395", "value": "4143e1ac1cd5ad1305476a77c8b4e1c4a39b0b35b04effc94daebc3db94bb91a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496876d6-9d7d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618444699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444699, "uuid": "5c37f0b8-75ee-477b-8344-5828d2b00636", "comment": "Malware payload", "value": "db04c7083a92833650898ab6fc929f9a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444699, "uuid": "a27845f4-2eb4-4dc2-a9b3-3bc694ffc242", "comment": "Malware payload", "value": "4184b39fb514860a7c1b9e3cf72a7dd64eed8c21a36262d343610157c7bb0713", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444699, "uuid": "d9eae04a-7e0a-4760-8d92-70ae0ecfb05c", "comment": "Malware payload", "value": "a882bd60ae6e058d685009c66c9e1672e6ff3c5b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444699, "uuid": "08861720-d8a8-4777-a936-6f36240bc052", "comment": "Malware payload", "value": "1bc6244c7d374b3a3c25988447f62c4e2ff5baf631cd7d2912a19ccf6c3d7354afa54cfb405bb928fd50f42838d027e8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444699, "uuid": "1a026acf-fa86-43f9-8fd3-359c850661c1", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444699, "uuid": "8409d0f8-eaa9-403e-8c35-6588e484abf4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444699, "uuid": "01d2250c-65af-46d7-8baf-1d47f8f863a2", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618444699, "uuid": "8aa29191-bef9-4fc8-ae46-384deb9dd1a5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618444699, "uuid": "d69b9ea3-485d-46e6-b15e-95b7f906230e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444699, "uuid": "84656ac2-3c46-4e91-a893-dc20b356e9b8", "value": "4184b39fb514860a7c1b9e3cf72a7dd64eed8c21a36262d343610157c7bb0713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8955602-9d24-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618406741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406741, "uuid": "104eaf4c-ecc5-4f30-8bea-ec485f05187a", "comment": "Malware payload", "value": "6fdf12977f70fa9a44c7ca03102fc3cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406741, "uuid": "74e4ee7a-543e-4497-b925-ad339ba01aae", "comment": "Malware payload", "value": "41d93ece3a760423c0b67b98e249d36adf758b7c64ffdd55481cfdc7866e4ac2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406741, "uuid": "13d0f8f8-ccf6-49df-988b-66fc9afde25b", "comment": "Malware payload", "value": "720e0320c7e867c5b6c96b17f5ea78968754c7ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406741, "uuid": "9423d6bf-d83f-4210-9c7a-dad3bd1b94f6", "comment": "Malware payload", "value": "6226c26c4a1a4a92889f57ab57ab397587e823ea6878d129636e3052f5d043daa9eff6a3417d261a660b525ba420051c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406741, "uuid": "2444bb73-0471-4389-9c4b-04101c25bdc6", "value": "04153387659910DB16EBFDFB44DDBC04B7AD621DAEC0890AD1D04E03663D44363BAB2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406741, "uuid": "24fd3c0e-4c7a-4f70-9bda-bd8bb96e220e", "value": "24576:X68V75wHR7TA9rupL17YetFGM2jLPRFpF63c7Gwf:XzV1wx/A9CpLpZGM2jLPRFpF6KTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618406741, "uuid": "707ba22a-6d92-4622-9060-abad04a1ebf4", "value": 907011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618406741, "uuid": "a5d03415-f5e5-4e64-a8cf-de7b10ed2fe4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406741, "uuid": "76686c6e-34ce-4ff6-9c87-f75de127ffaa", "value": "AU090000000.Gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41012b23-9d6c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618437383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437383, "uuid": "5fd32892-3b7c-42db-8abc-468c592f46b0", "comment": "Malware payload", "value": "ce03af692d64f2fb6a08de9dfb515525", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437383, "uuid": "76cce22e-73bd-4a2b-9580-2501e9234aa6", "comment": "Malware payload", "value": "422eaad2c6d0ed6a11b859f844beaec3ec309e05f9626c63b291a8fc8e2d8a40", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437383, "uuid": "456f5de3-8fb9-419b-b2ae-c82df0e7ecae", "comment": "Malware payload", "value": "4f03bad7b8812e8e39719c1e140e85de1606c61c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437383, "uuid": "523e4fc6-77bc-4d92-9786-a533e8cd9f28", "comment": "Malware payload", "value": "51b0476309f367d92b3714864b0ed3c40b42c18d770777adb66abf756cc6046898afd155340d2adf6f476484d6ef5256", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437383, "uuid": "3771699d-1cce-4625-9988-70a40b9a8a7b", "value": "0B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437383, "uuid": "87e49af9-aab5-4f52-87ce-18c3b6869d59", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437383, "uuid": "49c566a3-7a5b-452d-a864-00563ead798b", "value": "3072:R0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:EpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618437383, "uuid": "ace2d05c-cb1c-4fa1-88c7-1f74ac99ae72", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618437383, "uuid": "ef117e7d-6e6f-4ba7-96b9-84e29dcd688e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437383, "uuid": "c711c3d1-5fbf-45b5-8cfc-d9f7f8531513", "value": "422eaad2c6d0ed6a11b859f844beaec3ec309e05f9626c63b291a8fc8e2d8a40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0b9b08-9d47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618421804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421804, "uuid": "425b66ac-2b9a-4255-8746-34c995507d41", "comment": "Malware payload", "value": "dc16891820ee5289c3c24b961a6bc299", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421804, "uuid": "769e9b3e-9d80-4a28-8f2b-2de192f65182", "comment": "Malware payload", "value": "442a01c0f22b59c8585b7eb71cc6b3ad5a9da2fe3493bd8e42e50c875d8ffb02", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421804, "uuid": "ac65f5ed-073d-47eb-8631-79108c1814d0", "comment": "Malware payload", "value": "fad5fe32a28273b1d4c3d5d7955619158180dc10", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421804, "uuid": "fae12833-eee8-4f55-9008-b31f255c2634", "comment": "Malware payload", "value": "2870064c0962ebda971ba93c5b74833e8bf10b4cc3041c872c11b5b97a8c12bad433a49f7818c12bf8fe4f8ec47608af", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421804, "uuid": "9e3517ea-0b40-4bf5-a352-b170502b1d39", "value": "9FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421804, "uuid": "dc2a7470-26b9-4188-b02b-fb39bd1a49ec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421804, "uuid": "2e16219a-5ce5-42a6-a64e-1fff40f5da1b", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421804, "uuid": "0863913e-f388-411e-8a5f-a8fb24e17e6c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421804, "uuid": "a75176bf-5058-47ae-8555-703099dc157a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421804, "uuid": "53e39e34-32f7-4190-ae58-829c9998af2e", "value": "442a01c0f22b59c8585b7eb71cc6b3ad5a9da2fe3493bd8e42e50c875d8ffb02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43253a9-9d7b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618444099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444099, "uuid": "3fa1121b-d431-456b-8612-5e220aaf9c48", "comment": "Malware payload", "value": "33cc9ce4ac54e03380527cf230cfad75", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444099, "uuid": "76511df2-5e14-4d07-9153-a5ce969ec6f4", "comment": "Malware payload", "value": "4461679ca9f0a85fbd279d94837cdfa087c1e5e980337d4737675fa1297508a0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444099, "uuid": "7831b2b1-82a4-4e66-8477-c12d9a4c7358", "comment": "Malware payload", "value": "14dcb570cc209370d3f123c33c01f9ad46eabdf2", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444099, "uuid": "75679ea5-8b68-4718-b1de-506987d4e06d", "comment": "Malware payload", "value": "fec1fc4166960e8940ef1e42155a204f0d634515826cc89b75e2f5e92b755e6e669c2b640d3fae8b170a0d66b3ac781f", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444099, "uuid": "4ce8702a-51a4-41c6-8053-ffcd9e8e81aa", "value": "96F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444099, "uuid": "496c5bb3-2594-4989-87ba-5755be4b1db6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444099, "uuid": "5380c85f-8ba4-4f24-906c-ee536f1180cd", "value": "3072:8lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:8lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618444099, "uuid": "d7725a78-a689-4e11-9a98-004db37ac708", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618444099, "uuid": "f1ee603a-3e17-4426-9483-35d461cd2b5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444099, "uuid": "5a0f1561-b13b-46fa-a1ef-425001b4d87c", "value": "4461679ca9f0a85fbd279d94837cdfa087c1e5e980337d4737675fa1297508a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bc0aa0-9d3f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418124, "uuid": "98161f70-4b95-4b65-b7de-c26ef80ded80", "comment": "Malware payload", "value": "6e1045d3d5ae5c3ddf461a4cd9c34b59", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418124, "uuid": "d01eeba1-7e1e-4c1a-853c-e532e79cd081", "comment": "Malware payload", "value": "44c6d798b1af94845a25c6e13034bd5ace6f4dad7b542413928e4309e4198747", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418124, "uuid": "7249d586-47ac-4d38-bfb6-3c797db10361", "comment": "Malware payload", "value": "c287a9b586a712ddab499579e2cab6e5d60888cc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418124, "uuid": "bf5f9b75-c74a-4f3b-8627-8c8041b5437e", "comment": "Malware payload", "value": "1004024c0e4ab3b78f7888f012820db5bfcd5ebb1a7759fd24821e1075baaa6fe084c5d901e84e0a530510e91abf79cc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418124, "uuid": "5911fb5a-c619-47e0-8966-191999b3c847", "value": "73249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418124, "uuid": "16dab8cd-db7b-4bf7-ab40-3af6f8548479", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418124, "uuid": "d3eadc26-1fd6-498e-8b06-af1e717cd48e", "value": "3072:w0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:LpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418124, "uuid": "7e70b3a4-31d3-433b-a8f2-fcc3d7b5e00a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418124, "uuid": "0f8ae2f5-c4c0-41fc-91bd-6a89c64cfe2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418124, "uuid": "dfd1825a-2a8e-4641-9ed2-9e49c6e4e939", "value": "44c6d798b1af94845a25c6e13034bd5ace6f4dad7b542413928e4309e4198747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d287e93-9d48-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618421834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421834, "uuid": "1d7a0464-5eac-4c5a-9f22-e999ff54f27b", "comment": "Malware payload (AgentTesla)", "value": "440a5f92bf0b0c98f26a9557dd4d2291", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421834, "uuid": "76da48fa-a974-414e-81c5-bb5a66849717", "comment": "Malware payload (AgentTesla)", "value": "451591f2be9ec57375e8cf6239bb237c08a7d2f32ba346d1e6a8bb9345f68a3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421834, "uuid": "c14632e3-72e4-4237-b963-1e95e0b3ff40", "comment": "Malware payload (AgentTesla)", "value": "20b6a08970e16b83b30112ef7a6b9a0dc3554e8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421834, "uuid": "2d8f3f49-e9ff-4af7-b423-7220eb4419a2", "comment": "Malware payload (AgentTesla)", "value": "44bb51b42e5dd4aeece5d59fc0952710db952fc3f332d272d1829ae754f1affb3b5b33ea6b958a9fed858e361a02488e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421834, "uuid": "0b70ca9f-db94-4b08-903b-d078843b6849", "value": "1BE48D0123486FA9F17DD7B5A0A8A90197F0E407E32DDEAD7ED984CE04A5F51CF92A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421834, "uuid": "da91f468-01d4-4725-b2cb-9185512ea693", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421834, "uuid": "92096a29-1b1a-4f7e-b6af-43255fd48ec9", "value": "6144:+ivi/Ked4oZfzqbdCgHn1yp/p5ydROtD1WjVtaH2rzkWlJs/G5HbK7BrVbMMDYnF:ACeJW318/1ZTWQ+5H2FrV4E42dqdgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421834, "uuid": "e7d63bc4-c826-420e-878a-27668788e2ef", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421834, "uuid": "83bcb22f-d2bf-46db-927b-a6b1acbedb8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421834, "uuid": "c2eb92f3-0b75-4195-bfb4-5908e8d47cad", "value": "Comprobante de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0032b55a-9d48-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618421813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421813, "uuid": "8c7103ca-2e15-4fe7-82fb-127cc7eb77dc", "comment": "Malware payload", "value": "10848be17f4b49052deeb6df3c482e20", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421813, "uuid": "22b86792-8f6b-4d9a-a677-12126e0e9d90", "comment": "Malware payload", "value": "460a50b7d37aaf6c1964e54593333fd6118bc0f86e9316eca0e0cd37ea1ca94d", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421813, "uuid": "a7a9acc5-a7ef-4b45-9444-5a5eb5197756", "comment": "Malware payload", "value": "65964d43e0f08f266c6f4eb04827bf04823d8992", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421813, "uuid": "92453a1b-5b01-4934-a023-58b531ef6827", "comment": "Malware payload", "value": "a398604a31b15ae23028b495b9ab8543ae63c134e05a9f67d76c757db847f05450f2d4efe27322823ed69c5f2ad17fd9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421813, "uuid": "691790bb-4224-4b61-b3b8-23cce5ab7cdc", "value": "CE6423A4962AE932DFF9AC38C22B4D972D8C34C4803AB64F594CF017955792732E539F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421813, "uuid": "4a63d600-a551-4fb7-9958-02007fc443e1", "value": "6144:jHlulVYeBf4rUud2ugUZeSyh0ageF7kWc3x8nx83Ia5XjSG5Z:4BurUruPZM1tch8nx8rNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421813, "uuid": "5e3016c3-bad8-45db-aa21-710e38730067", "value": 310269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421813, "uuid": "35a14274-7257-4c87-82c1-838164fa0b31", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421813, "uuid": "8c4869b9-44d9-4a88-9e7f-4e3a8e96f1da", "value": "Invoice_922440.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63415477-9d50-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425415, "uuid": "2dc6f37e-2da6-4fac-ba70-fdbdcae2b454", "comment": "Malware payload", "value": "932084105ac7187a607dd9efedad0f71", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425415, "uuid": "8b564c1a-514e-4c19-8c70-2b14c61e5068", "comment": "Malware payload", "value": "46407c5609da20a14c9cd14f095cdd5c5064ceb12c5ee8ec52fea379cd1a895f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425415, "uuid": "1d4d6c90-0ecc-43ec-b61b-6a44a4b998b6", "comment": "Malware payload", "value": "0bcbedc968a52485dd4d277dc855bb132ff90fcc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425415, "uuid": "2d882c4d-7c60-40fb-bbb6-e08194e1915e", "comment": "Malware payload", "value": "db67f95500c51de6bf4eea29c6b67c6304e773a593af716487fd3556ad9b134a3fb0d9bfd196cc6b857cf4577e6c369a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425415, "uuid": "4ef03501-1b3c-4726-9ca2-70dd9e7daa06", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425415, "uuid": "c3ba806c-9c86-4a61-b4f1-7cc365b3407c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425415, "uuid": "e47067b3-d743-41b3-af1f-cad288abf84d", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425415, "uuid": "b2245148-ae2e-4cf6-a078-78b7362ac312", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425415, "uuid": "07172ec4-e938-4c18-866e-cba9b7a946d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425415, "uuid": "ddacbc87-a831-48c4-bef8-c6d5c01efafc", "value": "46407c5609da20a14c9cd14f095cdd5c5064ceb12c5ee8ec52fea379cd1a895f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd321f3-9d53-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426617, "uuid": "2bb611cc-7c03-480f-9d41-d28fe6e78be1", "comment": "Malware payload", "value": "79a7f9f4bf8e2be7b74e16f931fecc99", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426617, "uuid": "50f4818d-7fef-4b17-9254-3196098d3cad", "comment": "Malware payload", "value": "46a3437e6e5bdb72ae5bbb618bdc01a755115f2c4959163720d47545aed0fc88", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426617, "uuid": "cc85ba80-66e0-40fc-b8fa-87d8447e68eb", "comment": "Malware payload", "value": "252a1299da2f722400143080a94dd43419e3e03f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426617, "uuid": "3939cd83-0752-4f66-9b53-28d3003b3534", "comment": "Malware payload", "value": "a64a58481c9886b6ae38c9bc84e187c4ac2529a9574a882862929c9d39f4b7f06d62c39406e37e6a6aba11a7436cd4de", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426617, "uuid": "7e171fe9-62d4-4601-b227-bc165845ba43", "value": "87F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426617, "uuid": "c6341d95-e460-421d-9d0b-eb2b399cf4ac", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426617, "uuid": "3bb34ba6-2b5f-4a94-9e7f-6c528359f779", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426617, "uuid": "a52074c0-cefe-47e2-a4e7-4ca4cba1edc5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426617, "uuid": "515de7eb-d4ee-4a8f-aa91-1fe64274eb4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426617, "uuid": "412dff58-ec18-4245-adff-c74501ac4c87", "value": "46a3437e6e5bdb72ae5bbb618bdc01a755115f2c4959163720d47545aed0fc88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caddae45-9d73-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618440621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440621, "uuid": "c27449b7-66e1-4df2-878e-6ae613107fd7", "comment": "Malware payload", "value": "8628bafa695f3443de930f94040d04e5", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440621, "uuid": "0cd38f3a-6d41-49f4-b9b5-69ac1889d4c7", "comment": "Malware payload", "value": "47039e56b87c48f621070281ee19f8a02fc6b647cac11070db1c16db608322a0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440621, "uuid": "4c250a0f-810c-4c8b-a2ac-f444ddc5715a", "comment": "Malware payload", "value": "247c66697f28e61cfa881a45cfe81511d4d51189", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440621, "uuid": "6f8f15f2-f53e-493c-b370-68f0c228d5be", "comment": "Malware payload", "value": "5f8cf02b493e014300975d9c4c87b59ace4e6e7f2b31439034787f7f01dae209dcbff7db1154728a248c955ad0f30f87", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440621, "uuid": "3dcd9cd3-be18-4f39-b7a8-5874714ea88c", "value": "9DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440621, "uuid": "5a1f7898-1ab0-4e9b-b72c-c82829598864", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440621, "uuid": "34bd38d4-7647-4fa6-b7f9-c7e272e40505", "value": "3072:vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618440621, "uuid": "3dfff99d-4bb1-441d-b34f-36a719fa4ced", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618440621, "uuid": "d08ba8fe-8de1-495a-8efe-bf54b8bff70d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440621, "uuid": "e1383eec-1248-4e15-9cea-9bc44adde238", "value": "47039e56b87c48f621070281ee19f8a02fc6b647cac11070db1c16db608322a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75e383b-9ce8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618380861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380861, "uuid": "1e90ddc7-cefc-4e87-90ec-d525bedcb2cf", "comment": "Malware payload (AgentTesla)", "value": "45f81a7bc9c2a142bb164dd574a61603", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380861, "uuid": "752014ee-92b4-4f59-b3a1-05a9065b8a20", "comment": "Malware payload (AgentTesla)", "value": "479eb1cc36dde7f741cb062ef67f8da0ab7dc9035c0a937a296e324fe80cc68d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380861, "uuid": "64e4dcf3-3da2-4733-8ab2-b1fca3df13b8", "comment": "Malware payload (AgentTesla)", "value": "6acc9e6e7f71b73c4a3e2c103a7d7f834b7630e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380861, "uuid": "45791a38-61bc-4b39-a635-72ec7fe4c5b0", "comment": "Malware payload (AgentTesla)", "value": "24b7144b643ca1f1548c5d026055a6de46fd3bc0873b9840e2e462f351210399b1af827f2c2e70a6be3ec7f5986cab67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380861, "uuid": "9fa0cfca-b213-4047-9f7a-667b0358c8ba", "value": "35D4230DC009A913A4BB929EFAD63FD8929D85C854C255F682CF83DED92D859CD8F039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380861, "uuid": "c49140a8-bd19-4ba6-aa60-e687d5b68cfb", "value": "12288:QiOBAfYUCpzz7PJ8/QbcMHmLNu1cQK/+IL8K5FP5+sG65VFUw/o2JzNuMArtnWFB:9VCh7RJbcMSu1cHnFhbj3plNstnwyqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618380861, "uuid": "eb3fbb77-1400-4238-acfb-ee98feffd0ee", "value": 653285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618380861, "uuid": "19b4811e-e2f2-4377-a074-4788b575757c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380861, "uuid": "79e6bfd5-dda3-44ff-b74f-e378f2824deb", "value": "outstanding invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f258c12d-9d5b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430379, "uuid": "1ac8750a-9a40-41f4-b14f-ffc382dd3091", "comment": "Malware payload", "value": "b7318282a0685fc8d9187deffaad022d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430379, "uuid": "4042d39a-5cf3-487c-9cd9-fa9f4c30b69f", "comment": "Malware payload", "value": "481971fda5d75360395b7788fe2519f48d66e52102757d1b82673fa4e2e5b2f2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430379, "uuid": "95ea0203-8cae-4989-a976-25bfd8df9738", "comment": "Malware payload", "value": "3c808eafaaff48fea3afdbdfe1e1db681b53b715", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430379, "uuid": "9c351269-dbe3-44aa-a626-336cad079f26", "comment": "Malware payload", "value": "efa918898288a7a475355b54561aaad268b7d904a5ce39d4e260860eba0b8bd3928daa97c3569b1d7eb77faf30cbc1d4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430379, "uuid": "53b2d95c-7493-4471-97e9-d85513d28af4", "value": "B1249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430379, "uuid": "5beb3232-a38b-4f0e-a5b3-f7b233cb9ee0", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430379, "uuid": "12651e5f-4d78-46bb-bf73-e5374038995b", "value": "3072:/0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:epepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430379, "uuid": "663fef2a-6dba-4891-9160-5b0b081848f0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430379, "uuid": "e930c71c-be73-4a7e-a009-da97586171e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430379, "uuid": "f6a0a1ee-0b4a-4f26-9958-929012ea6710", "value": "481971fda5d75360395b7788fe2519f48d66e52102757d1b82673fa4e2e5b2f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b893f0-9d5f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431974, "uuid": "cd1571dd-1b13-4eae-84fd-c6bd872dd244", "comment": "Malware payload", "value": "0167770c7e4caa5d7874deac22b33c7e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431974, "uuid": "0846ecf6-8c68-489d-946c-f3fc42213c1d", "comment": "Malware payload", "value": "488f72f2f2806b1dcee1ed4e4486129bea439fc38bc5643b6d5bfeb8d633c397", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431974, "uuid": "51c95d46-d1ab-48b5-8b21-0e3a970c7f90", "comment": "Malware payload", "value": "07ef0f547e1baeedfe68377f200ec2de801fadb6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431974, "uuid": "dd177856-ef57-4c8d-9d0a-ea2fc9c7eef7", "comment": "Malware payload", "value": "52f19c00d287fe91763ee276c53d50762b47eead2b0a5ebcd5977b6d0d82a83af39d0c83bfa88424855b71bd4ddeea96", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431974, "uuid": "0a79e83d-2d74-470a-9ab7-b8f6f7f6ee06", "value": "B0249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431974, "uuid": "3453540e-b43a-46c1-bbb8-b3610027d7e0", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431974, "uuid": "f86c9d4c-06c1-48bd-9c1e-fbbb9117e3be", "value": "3072:k0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:PpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431974, "uuid": "37fddd43-2c54-4e1f-98d6-a8a76f961baf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431974, "uuid": "c066c0e3-5225-458f-bde0-c9af049ec591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431974, "uuid": "767a5dad-0223-4df5-b4ab-d569f1a07dff", "value": "488f72f2f2806b1dcee1ed4e4486129bea439fc38bc5643b6d5bfeb8d633c397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fa90dc-9d65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618434303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434303, "uuid": "a798668f-a957-4d0d-99c1-70c6cc26a98d", "comment": "Malware payload", "value": "af55887620be2e6e4e9cebaab8f01b64", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434303, "uuid": "d854955d-6d68-451b-824f-0d86bcbca020", "comment": "Malware payload", "value": "49200e4a323b57e1ed97a5c6f684a37232f7bd527842cb5e37fb6d26dfe16cba", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434303, "uuid": "6b8abbba-b7f0-411d-a7e9-759fdaf4dc0e", "comment": "Malware payload", "value": "48d7e6c9dd5a67990dee0a445e60f443e39f4459", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434303, "uuid": "1184a66b-80e7-44f0-83ba-bb8584dfedd2", "comment": "Malware payload", "value": "c094467e29965f03fd5f01e4d2f19c3946c428a22a36a5f3e02203ff7db04cd107b2683e3430e8d00e3eaa38fff05d9c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434303, "uuid": "5dbb54d8-f16b-4405-8acf-38d8cb8b1e8b", "value": "54249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434303, "uuid": "68a006a3-53f1-433e-95a8-5622126ab38b", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434303, "uuid": "7b3267e2-ce82-43ac-ad10-a8ae8d737e5a", "value": "3072:20DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:VpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618434303, "uuid": "88d0455e-0016-4d29-a3d4-3117f065b3e9", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618434303, "uuid": "19842d98-151d-481f-9262-dd520d05b3a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434303, "uuid": "ec97fdb5-e620-4384-a647-6b872a22050a", "value": "49200e4a323b57e1ed97a5c6f684a37232f7bd527842cb5e37fb6d26dfe16cba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23992a6-9cec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618382678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382678, "uuid": "9e9ed35f-b791-436c-8c7b-d2becfe96b52", "comment": "Malware payload (Formbook)", "value": "a75e61a0b35d043bd23376171eec3625", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382678, "uuid": "2a64b4b8-467f-4ccf-a6af-f25d8d6f1ced", "comment": "Malware payload (Formbook)", "value": "49e983e59b1283d49b98bbcb25b61a7bb440d20e3c09dc0b73a3b7b749bcc1cf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382678, "uuid": "56df39a3-ef4d-4f4f-a868-0631591e86d9", "comment": "Malware payload (Formbook)", "value": "a787bcfe50f1cdcc23b1aa1ee7c3fef951f172cb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382678, "uuid": "4c5c45a3-1ec9-427e-9977-aaea9de4904d", "comment": "Malware payload (Formbook)", "value": "ed34ff439b5357c36e8f13dc892460504f872a85d71c142067cd78244544e32c76338c7d09e4ef9cb875d032382d4573", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382678, "uuid": "d0d873c5-5fc8-41b4-8520-1ee60a03b7c7", "value": "ACB523A6F75D6B65C63E1B78A03FE25000BFDC6525DA5C5283053D48E0B2EE0E5E1E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382678, "uuid": "3c241ec7-6643-444f-9ca5-9aa5c7bc7135", "value": "49152:kRi8m+72EnfSsRkY5PeGQhWpFXABHk3pC+uE8:kRjm5EfSo5PQhW6N++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618382678, "uuid": "a1725033-6d07-4432-aeda-58aeccf20af2", "value": 2456064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618382678, "uuid": "0aba9761-9763-43d6-8a18-8e07054f0261", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382678, "uuid": "660e64a4-5b23-4d11-88bd-5d0a68e118d0", "value": "Request For Courtesy Call.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931c8f88-9d74-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618440957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440957, "uuid": "d7291335-4071-472b-8cc3-64106254a76c", "comment": "Malware payload", "value": "af0823a04bfeae7948c4dbf755abcbf9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440957, "uuid": "9d9f538f-f211-4680-ae21-eaa94f4b2e61", "comment": "Malware payload", "value": "4aa6924d6651bc1586d1cc4ac91f1306591d323c620078edc9a03d5c76093be0", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440957, "uuid": "0add335b-78b9-45e9-95d7-54f0ec7ed2fa", "comment": "Malware payload", "value": "e6874c13559aa1229d9546fe7ca78a4a3cbe6d36", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440957, "uuid": "e6d21070-c4a6-491a-8bf6-cf4c95fc7fbf", "comment": "Malware payload", "value": "32af6c110cf8da0ae9307c6e25d7eb672da27b206fe951e227d47e658fcbe88c259827e20080f8e879e4a95243f1f3ee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440957, "uuid": "cf1c85df-9fee-4079-bc92-a5b91efe7612", "value": "86F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440957, "uuid": "72797b04-950d-4348-86e6-ab4e9d0e4346", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440957, "uuid": "34b7f91b-c8f6-4d37-83a7-9146887f98f1", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618440957, "uuid": "6c8e9eb8-f1f3-429c-9985-8b9d643d587b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618440957, "uuid": "e2ad93b1-60f7-4557-a644-c53955fb22a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440957, "uuid": "0044ab83-a1d4-4cd7-983f-68676eed523b", "value": "4aa6924d6651bc1586d1cc4ac91f1306591d323c620078edc9a03d5c76093be0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f633a4fe-9d4d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424373, "uuid": "ff272278-d8ac-4d0b-80f0-8afb2003ab06", "comment": "Malware payload", "value": "c98b01d805f0ab4e88e425083faa5fb5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424373, "uuid": "1723e67d-8d15-4d1e-9905-f7b2a2a3f0ae", "comment": "Malware payload", "value": "4b385f02b20db61d77890c78278df53bf7acd58d6135446fb91a7cc15b81ac3f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424373, "uuid": "b6a675ef-b43f-4c28-b760-9a79622285c1", "comment": "Malware payload", "value": "c6107472a61e0169f1fa0440939a1204a965c8b2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424373, "uuid": "96f27723-90b8-419e-9f96-ddb56c3a6a8a", "comment": "Malware payload", "value": "3ad586fab34c20a6250d4fdd607aa0c04b9bb4c41182f9f88fb7be85f3d87b3a6e7dc313c7cad68170c404c092c68425", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424373, "uuid": "a4d28dbc-f1e1-494b-b15e-c896fe0cf437", "value": "E1249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424373, "uuid": "1d09062a-6985-4eb4-a365-daa6af7892a6", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424373, "uuid": "fdd05f8f-1532-47c4-b087-a4b1374c1b4a", "value": "3072:H0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:mpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424373, "uuid": "3ff43ea3-80b3-4fb0-8eab-09fe4cdf35b6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424373, "uuid": "c5c8ab1b-f2d0-46d5-b03a-e5324de66b3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424373, "uuid": "5e5ab965-048a-40e7-b477-58c1903790e9", "value": "4b385f02b20db61d77890c78278df53bf7acd58d6135446fb91a7cc15b81ac3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73908010-9d2c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618409980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618409980, "uuid": "a06bd9ff-8a85-4b44-bf56-d11bfb62d563", "comment": "Malware payload (AgentTesla)", "value": "b7ae2431ca71b7dcb999941ac6d15e0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618409980, "uuid": "5d8cdb21-ba24-45bd-ac23-b07ee4062886", "comment": "Malware payload (AgentTesla)", "value": "4b6f88c2616931dc71e37b221476b1f9eac77c1007c14ee6b346486e646f8853", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618409980, "uuid": "526ccae5-00d3-4b16-89f2-8c466e82a91c", "comment": "Malware payload (AgentTesla)", "value": "16b37a16d8d2136f8b09e84ff333f312368cd49b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618409980, "uuid": "88cc41ce-ec8e-4e5f-b0d3-c300abaecf1a", "comment": "Malware payload (AgentTesla)", "value": "340668dcd7e7a5cba3a0d4af07eb1e5c021a5f80271a8c73d25a39b36a688dd90f756833025b8fd573aa6d0ca424a085", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618409980, "uuid": "7c27b65b-3226-4ad5-a56a-d31753bf1bdd", "value": "60F40164695EFA9BC81D16B6C49084B103B75397D352DB9FEC9E20CC47E4782F92C2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618409980, "uuid": "51523188-38e3-429b-ac04-2e9251ed5ef5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618409980, "uuid": "69484ee3-46ed-440e-b10f-b4e22e790c4d", "value": "12288:2VNO3Mjd/6v6+BwO7Pkei0qrZ1OIpihhJCQPpzVTL/vcS5c:2q3wB6vzWoPlurvMhjCQPpz1L/v/5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618409980, "uuid": "8e5fcb36-b419-4327-9121-2136a81d5676", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618409980, "uuid": "c410feb7-e681-4bf3-ac4b-c8cfb086fe8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618409980, "uuid": "d163fffc-d54a-4311-ad30-c4f6dfd5e7f2", "value": "AWB-182676389205111_ES.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cd2c2b-9d3d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618417262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417262, "uuid": "ae34d80d-5155-4a36-854a-aefd36abcb04", "comment": "Malware payload", "value": "f34fc72fe3f17797deca9d3c509202d1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417262, "uuid": "37f56d79-b2b0-4e9e-a65e-0fce2445d085", "comment": "Malware payload", "value": "4c0dba17b2347ceb4814e50bf3b888193cc40f08a1d81903bafb63ce576b0896", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417262, "uuid": "e164aebf-49e6-48dd-9258-b4e1de5bcf4e", "comment": "Malware payload", "value": "5d77a9425cc3a6efbee62aa58d24279ca0a7ff19", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417262, "uuid": "c2949d85-da76-4b0b-92eb-7a9ad13e222a", "comment": "Malware payload", "value": "cdd3158aeb16af895ab17d9d9705ccc3b9f7dbe54f27b78aaab2f87bb8ef1761193c24c1a471011ff543636d7033adce", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417262, "uuid": "1480be25-89c3-4505-940b-f5a033b8a7a3", "value": "FFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417262, "uuid": "af282e13-a738-4612-93e7-b57186b50088", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417262, "uuid": "4a01bcec-9ca6-40f0-a6a1-9aa745227677", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618417262, "uuid": "770c6d2b-df75-408a-8bf7-c9ad08b281c4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618417262, "uuid": "dc755e77-0558-4370-82d3-c5d932d71110", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417262, "uuid": "926f7339-4673-4ac9-9a72-47b759c0626f", "value": "4c0dba17b2347ceb4814e50bf3b888193cc40f08a1d81903bafb63ce576b0896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce71ba1-9cd4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618372012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618372012, "uuid": "1960077c-fc6e-4e4c-a359-e35cee59d411", "comment": "Malware payload (AgentTesla)", "value": "b79168dfd34f201f7a29a584ac6714ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618372012, "uuid": "cba22239-7029-4f76-b32f-18015f6edfcd", "comment": "Malware payload (AgentTesla)", "value": "4c1dd52b4a02ef9d9fef4d804e11d9acd808c905037c4d60157e8ccc30b231b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618372012, "uuid": "6ff52d9a-2f19-454d-abe9-488bfe5c629f", "comment": "Malware payload (AgentTesla)", "value": "17cecccfa96c80adb3edbde938cb8158053cce89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618372012, "uuid": "a2059763-9768-44a4-95c8-f91d413748ac", "comment": "Malware payload (AgentTesla)", "value": "11a4581c8c57e6ac9d8f0dc4ab74573e095be4bc0ebbaeb6b55c1dec6af70248f8230e47ad3190c55dbeed02e3b4c9e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618372012, "uuid": "853abcac-c928-4911-86d0-ff8abb599759", "value": "7AE4AF10A694F596C9AC1B766A16DD300B227DABE215C52B34CC3CCF79F5BA3F148293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618372012, "uuid": "3792d5bc-ede3-4051-9081-5aff08dfa18b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618372012, "uuid": "6159bdc2-9111-4672-94d7-6fe276e62c2d", "value": "12288:qz8zNA/MCzXKpmwUI5zv4s5wJdDJMt/52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMME:qz8O/JzXKphXL48wzDJU/52MMMMMMMMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618372012, "uuid": "2dc8276a-5395-4687-88ba-349015b4fa8c", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618372012, "uuid": "8150d291-c7e1-43f2-9677-732c524bc754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618372012, "uuid": "078d0998-4c48-43ac-842e-8b6e6b684fc3", "value": "Ningbo_Outstanding_Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e785f555-9d6c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618437663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437663, "uuid": "861c71a6-a069-42e5-ac68-1171b42c32c4", "comment": "Malware payload", "value": "935ed57a75f505cdf47bdbc55acbdd7b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437663, "uuid": "cf416623-9572-4264-b57e-ef13a955525d", "comment": "Malware payload", "value": "4c77e4f3ed5404362367d7348af029bf1612d3e1a696843dc09519cde0eb74b4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437663, "uuid": "3db6550d-5995-4b5a-96b2-ba7812d12265", "comment": "Malware payload", "value": "9b043f2198098c869fc4b5f2d457b37f6cb32987", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437663, "uuid": "4e94c444-ba4f-4695-a323-3ad7ee9c8a03", "comment": "Malware payload", "value": "36a0e5c6183ff6efc1e8d34eda4baddb7eb2df311df7d52a681f69a49176501433e76bb6df718ef599a99c5af79de1f7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437663, "uuid": "5f70b1b2-3482-42ab-a2ee-54edf64d6e79", "value": "69249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437663, "uuid": "8fbb4274-c372-4083-917e-14696dadbc66", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437663, "uuid": "c8ef3907-c177-4ddc-a1da-98208b75b408", "value": "3072:Y0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:zpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618437663, "uuid": "6102bb56-539f-4099-944f-63b893b5c54e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618437663, "uuid": "25a91aa6-d38b-4bc3-a0eb-4339f18d36c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437663, "uuid": "aae0ac6c-9a75-4344-8490-d950c55c1236", "value": "4c77e4f3ed5404362367d7348af029bf1612d3e1a696843dc09519cde0eb74b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e2d801-9d69-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618436259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436259, "uuid": "977fe720-3e79-4775-bbb3-d22568704e60", "comment": "Malware payload", "value": "46eaa8362a436b5c82ead39425836b13", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436259, "uuid": "5507655c-d45e-4a01-ab76-e339015d1f02", "comment": "Malware payload", "value": "4da7e70cf30e0638c91ba3295549f14cee8b836b90655a12eb52366d3feec233", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436259, "uuid": "d71418f8-909e-4b8b-9eea-a706887bc4d4", "comment": "Malware payload", "value": "e79a901e6029205c1b0c40c1d76305d1e2c16128", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436259, "uuid": "33cda290-ad40-468b-bec5-6b3791237b3e", "comment": "Malware payload", "value": "a2af443ffc6fc079442abe24569bbb4945c482de715426391bf9324d3f7fc9661d3d3a4c7936bc10294072842e1d8463", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436259, "uuid": "85fe204d-8c2e-43f8-a165-a6555f73bbbd", "value": "C4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436259, "uuid": "75894508-d60c-40d4-9b50-3ccb489c0d93", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436259, "uuid": "99d3d017-8cb7-4386-b9b6-b2e7bed61936", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618436259, "uuid": "25cbc9d1-3bb3-4daf-8555-ed9f34db5d6a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618436259, "uuid": "aafb8b73-dae4-4a71-ba6d-50345c6fdec8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436259, "uuid": "ef842b90-d7d9-43e0-9633-fc93b1e89383", "value": "4da7e70cf30e0638c91ba3295549f14cee8b836b90655a12eb52366d3feec233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a39779c-9ce6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618379846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379846, "uuid": "94cdb403-67bd-4da9-9026-18f7c295fa23", "comment": "Malware payload (Formbook)", "value": "c749b9f14b042153b956d4be4767be9e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379846, "uuid": "3604523a-8218-44c1-af2c-3650e617e367", "comment": "Malware payload (Formbook)", "value": "4ea2c495ba79d56939b549d8b1fc7fc23c5ab9bc3c7fde63aa9c07cfac67bd00", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379846, "uuid": "a33907f6-118d-4aa8-b97e-a9db0a223746", "comment": "Malware payload (Formbook)", "value": "b69dd0aa2e3a701ab5d288ad070d9dfb43d825cf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379846, "uuid": "7edf94cb-962e-4e91-b3df-d3cf6e225203", "comment": "Malware payload (Formbook)", "value": "d2b43ff7adc393d9ea97db4401d648a23e5637e89de75364b2293f10372f3c39db6953f9bee00e64bc5d12b6bf3414c6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379846, "uuid": "73dc87f1-c0b1-4c36-84fb-0a5e7faf274f", "value": "1DD42309F6C1F64A8AAB0E6B4E4C32117C49FE9A407C6FC5AE8ABF15D3CC21575D4C86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379846, "uuid": "e386046f-caff-4f70-9816-ca1d000d297b", "value": "12288:ZbCrU6EGl0Kb45tqmhXYV19Fvr2kbnHNlXv+3QqvrpnylYQANpAd:ZbC6G2KbARGV13PH/Ggqtyyj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379846, "uuid": "e14a767f-2512-40c3-a030-9084d6243eaa", "value": 620584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379846, "uuid": "e098cc21-cfaf-4820-a726-a08c31b37bd7", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379846, "uuid": "4a54209b-df5b-4c5d-a3eb-a910afc0c1be", "value": "RFQ-14042021 Guangzhou Haotian Equipment Technology Co., Ltd,pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9115fb8-9d24-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618406634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406634, "uuid": "651fedd0-bf57-4c1a-8f8e-42b23bf75677", "comment": "Malware payload", "value": "cb2f22663c1dc4e3029070e45879102b", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406634, "uuid": "5127751b-4e87-4c61-96ac-8634ae89f828", "comment": "Malware payload", "value": "4eadc4458109901e1d06b8fe24d0ddbd310b805fcca8246d99578597f96ee6db", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406634, "uuid": "f21a997c-fc47-4a02-952d-cafec9a38e02", "comment": "Malware payload", "value": "3ab8c297884df20398deba1f2d804322c8852414", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406634, "uuid": "6591f8d4-df38-4a52-9645-c4b588044e20", "comment": "Malware payload", "value": "88c0ecdfe277aa19e99611384dd918b6ccc831bf1329e3344fd38bec01fa8076ecdfff2ee2555fec96dd4ded926f9350", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406634, "uuid": "a50750e2-e9cc-42de-b208-95327fa2586b", "value": "05D423A677C3A62BEE561D3015A2E7388BB3D20006B7560773FC2F5CE7639278A15784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406634, "uuid": "4dfa34da-c9f4-410e-afae-2644e2f97895", "value": "12288:N7kFAhHcVUyiqTS0Rjfmb9iv9qCzL1C/l:N7kFAhHcyqTnN09qbC/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618406634, "uuid": "4cfc1ba6-6016-4274-ae0c-9dd4e78fa132", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618406634, "uuid": "b3ef5742-ee97-4e2f-ace7-8b52515eb147", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406634, "uuid": "c160657b-659f-4ee1-bb77-e820c3ac56fd", "value": "OC CVE8789 _TVOP-MIO 14(C) 2021,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e15543-9d30-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618411788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411788, "uuid": "2a31ac08-0eb3-4723-812a-82544050b64e", "comment": "Malware payload", "value": "2179de33d018271bb8d60334dd1d4ed6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GER", "colour": "#18DCA9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411788, "uuid": "b3c43042-fe96-4882-93ef-70f9e06e79aa", "comment": "Malware payload", "value": "4eedda82bcd9d7789aa060262cbcddb7dccc4661e70984ebf31f80954ffc90a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GER", "colour": "#18DCA9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411788, "uuid": "62e15b51-0a63-4d2f-98c9-3527bca6fb05", "comment": "Malware payload", "value": "feaa2bba1db09163c98908c990dcb04f7d5c19c3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GER", "colour": "#18DCA9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411788, "uuid": "ed951902-c656-4fb1-90bf-c9e54ba73c21", "comment": "Malware payload", "value": "e16545e8fd82f7cff1ded59b9feaabf446c5ea2536387bcebda01f9b237610aebf2c1eaf9a10d57b3ee242a7743f3c40", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "GER", "colour": "#18DCA9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411788, "uuid": "e455075a-1a31-4499-8148-6f9d0058f991", "value": "2894AE2136D1D036C026A675CE35C7F99AEA3C709D21594B3BDC2FBF2F30591962A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411788, "uuid": "2c6112fb-fea1-45f1-ba18-82410da91746", "value": "ef1b489e9b291cb418611244955c35cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411788, "uuid": "5b4d464a-042f-40ce-9da6-49573b30c213", "value": "6144:g3FFkYOVg1cV4oprLHiK1oR6NI2K2WVgRZWxxtZM/PWH/xiBiqUjdr:3Y+XV4oB7S6+B2HLW7qW7Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618411788, "uuid": "4c7c8b9d-06ea-4d75-ba5b-a6d50f909c35", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618411788, "uuid": "967c6f16-55cf-40a4-b186-d0c32325d969", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411788, "uuid": "eb56f878-c45e-485d-bc51-7a92de8569d6", "value": "wavaj4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf82f6c-9d6d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618438076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438076, "uuid": "30aeec51-d139-49fd-9e0a-a8fd4d516b1d", "comment": "Malware payload", "value": "34f49aa733b0be8e2e7d7ab1801d16b9", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438076, "uuid": "2b6a65c9-e36e-4c08-86c8-5f2bb028077f", "comment": "Malware payload", "value": "4fe9fb02fc1f685e13a77645f8d76be881ab9c7b30b5197d750cef7c52670b2f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438076, "uuid": "9883de31-6f58-4737-9f77-15d20403b63a", "comment": "Malware payload", "value": "d088bbe2cd34b9dbd5f4ede4d14c5c6198b06b5b", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438076, "uuid": "5650b135-02fc-49cc-9465-cee86b1b1b01", "comment": "Malware payload", "value": "6acc4149db8dbb1936d365c29ebd1b44b462b577ccdfbee00a81aa57b8fbe9d3694e76ab863901d21a4ed8a9b3945296", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438076, "uuid": "3030ee7b-5319-44ea-8cdc-8ddf128ed0ee", "value": "98F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438076, "uuid": "d8e8d67f-fe75-49d9-b438-ae065f2c3b08", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438076, "uuid": "12d4a7cb-05ff-4df4-a4a5-65816c5cab5d", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618438076, "uuid": "7a3131e0-7cac-46e9-a094-3f45e0f53cf5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618438076, "uuid": "096de8c4-0178-4a8a-980f-e217de42e250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438076, "uuid": "47deff75-7b58-4698-bb22-2fde71e41449", "value": "4fe9fb02fc1f685e13a77645f8d76be881ab9c7b30b5197d750cef7c52670b2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79d5be1-9d60-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432428, "uuid": "889f9d66-bf6e-4672-9c1b-e98cf56188ff", "comment": "Malware payload", "value": "f7eb8c232e4cc7328f0832fc5768b98f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432428, "uuid": "9304bd56-4fe5-42dd-83c3-23fd255fb6a6", "comment": "Malware payload", "value": "5043c58996f1ef21878713587ca2e4f0c07ec3858ad707970c519f6ab042a09e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432428, "uuid": "b1ba03f4-3b70-4617-aa2d-aebd331aa35c", "comment": "Malware payload", "value": "746a110487b11ef35a8f2467bc424064492f40ae", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432428, "uuid": "812696e4-cd70-4a8e-91ff-a69a6b4ad351", "comment": "Malware payload", "value": "90c116537d8507c9fc3f88b68c0af72a2de480a57a7059966f95f1b2e016e98bbc1ffdbeb7067fc93889275b844d7bd5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432428, "uuid": "038975fb-6aeb-4e0a-aab2-f5e3a295d882", "value": "5F249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432428, "uuid": "692cf13d-60e1-4a3c-99a5-28ee8a483a31", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432428, "uuid": "d7a9afa4-3686-471c-ab89-05c1c7f0ca6d", "value": "3072:O0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:NpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432428, "uuid": "9fab8888-8f7f-4ce3-bd5b-caee2aac54f5", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432428, "uuid": "ca2d1516-8b41-45aa-b859-605f3bf1d440", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432428, "uuid": "1d6ace32-8c4e-4b48-80ab-7dc777d658d5", "value": "5043c58996f1ef21878713587ca2e4f0c07ec3858ad707970c519f6ab042a09e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee6486b-9d47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618421649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421649, "uuid": "e171bb1b-9506-4881-8515-115eec4f40b4", "comment": "Malware payload", "value": "e6979b1f70fceb6961e99aa0162208f3", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421649, "uuid": "0dd98d56-a09a-4fae-99b4-4a69f54148ce", "comment": "Malware payload", "value": "50b218c6836334dd548802bc4e66ce8d9e68709e05d4ba2d5639322514215e5c", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421649, "uuid": "a69ea640-9eb9-4110-85db-f53d95440e72", "comment": "Malware payload", "value": "25a9a3ce24a802aeae0b966344d22cebc42de81b", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421649, "uuid": "4ece825b-0f96-4b7b-8084-f8728d60e581", "comment": "Malware payload", "value": "b5fbd0ddd3090f901cd7db36be8b74cf394a473925e02047ec2fd05f0c1c7257dcfdc186ae8645202f2fae9ec5da37d2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421649, "uuid": "0650ea7f-371b-45cf-b188-df75079a52a8", "value": "8454230CF3E99150EBF35D7C605C8EC2D665F2FEF91CE95E059A8994231ADB20312AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421649, "uuid": "d728a899-9a30-405a-950a-972e0e1c12e8", "value": "6144:jSgZzGltZE+UNytCn55b11pclSdFmYm3k8wGoDqKzyyoNE+W0WxwpFI:jSgZK3ZEFQC55b/m8mYH8pCvwpFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421649, "uuid": "4dc1701b-a2a0-4a4f-bda1-43ed9a292d25", "value": 296452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421649, "uuid": "1eee7c40-d4fd-4422-932f-98af2f8bc6a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421649, "uuid": "e3da400f-be8c-4516-b882-f54fc64372d3", "value": "Invoice_6424.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b0861f-9d4e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424498, "uuid": "eb4e7963-6c9e-46be-a619-46af2411f490", "comment": "Malware payload", "value": "62a52a99edf3b50aac703479fb2af13e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424498, "uuid": "be7cd479-913a-4d9b-9557-fc17be2fbf68", "comment": "Malware payload", "value": "50e1a1879a3965eed45da7f5f85c1af92dafcf481a23525af2243f95c2293fb4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424498, "uuid": "785c2234-8ba9-4bdb-ad9a-aa5440a6b9f2", "comment": "Malware payload", "value": "67a3fe17d366097bab68d0feab96a09550634168", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424498, "uuid": "d935c34f-9867-4a0e-9a3c-371b229d05c9", "comment": "Malware payload", "value": "f5dbe550a5c9c935e7a4d9807d2ca64c6e5ca3cba0854df385ecd3224bfe211051fa00b549e7aa0c864c823f6520a2ce", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424498, "uuid": "39f7bf9d-fee1-4057-9ef8-90bb652fd941", "value": "FEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424498, "uuid": "94e6be8e-de5b-4e90-9074-0eb5280acba9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424498, "uuid": "e120f2bb-113c-4cb5-8503-f348c6a0d6a9", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424498, "uuid": "e7cc562c-52d4-4f1d-8445-9a9533d1971e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424498, "uuid": "4f2ef286-0a3d-4412-b0fb-487997a01751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424498, "uuid": "f804ee35-f4f8-44dd-a6dd-6713ffc5f1c4", "value": "50e1a1879a3965eed45da7f5f85c1af92dafcf481a23525af2243f95c2293fb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d2fa82-9d68-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435915, "uuid": "bc06418f-7f1e-45d3-9052-6b46578da857", "comment": "Malware payload", "value": "e1d187ce02a5af8f0502ec71123d1c81", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435915, "uuid": "63fc74ca-6969-4255-8f43-fcd38c6ba06f", "comment": "Malware payload", "value": "50f36ad24b62d6b3bac4ac5c917414fbdb7e38079f11721af4bfe5fb0befc359", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435915, "uuid": "7b1adb82-00e4-48a2-995f-a3db95edf451", "comment": "Malware payload", "value": "41cfa1a7bb7c98c3118494758285a018b46bf0c0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435915, "uuid": "10d32558-8f36-4ad8-b3d5-fd5b1d7b84ea", "comment": "Malware payload", "value": "4ad76e6f8e20bcb7a7cb12307334792afcb7f2e166668c1f3d34855e2be50be127af81b54efc37d723a441fa30baccc1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435915, "uuid": "34ff7632-cba2-490b-b4c4-b390a538eefc", "value": "06F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435915, "uuid": "04fa9d87-b7a1-4cd1-b444-a193d875aca8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435915, "uuid": "4ebcc3ac-4c55-44b2-9e95-659b1e4a0988", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435915, "uuid": "d05f8483-95c1-4be5-9f1b-8c40756f3462", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435915, "uuid": "94a4be17-435b-4830-97ec-60da53fe45aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435915, "uuid": "e1a8b2ba-061a-4a77-93c7-e61231b3055a", "value": "50f36ad24b62d6b3bac4ac5c917414fbdb7e38079f11721af4bfe5fb0befc359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c5e420-9d78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618442671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442671, "uuid": "2e2e5800-58b1-452e-be6d-702caf43a400", "comment": "Malware payload", "value": "6f7c709c102d25fa599502c8e6d31221", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442671, "uuid": "3a9d3d10-840a-4e5b-baa8-002f537dc1b0", "comment": "Malware payload", "value": "51373c3a74c1d0eb8ecafdce7fd0d7c30f7afae3655a0f1f4b1d53137b51b36d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442671, "uuid": "1f6b9d32-d5ac-41d7-a3eb-e63a0c5ba0a2", "comment": "Malware payload", "value": "f7bf65b5c14209af830477e27889d33f60aeb5e4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442671, "uuid": "d8afc661-93b8-4546-b72f-d1081c162b57", "comment": "Malware payload", "value": "7503d9c359176b74760e3cead3100ea6e5e804a4f3fcf257c6ea50ee96def2c91b2029ccbf8e00e6f8f156cf80411193", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442671, "uuid": "8cf084a3-7677-44b7-bdcb-6fee83930578", "value": "19F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442671, "uuid": "97fe0017-cb34-49bb-940b-c95c711c8a8a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442671, "uuid": "a2f2bca0-f672-44c6-a62e-4c0c1ba0457a", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618442671, "uuid": "64fec7c7-c2c4-4898-8dee-9f2dd08773c1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618442671, "uuid": "f9d11685-e4c1-4d1d-9885-97d351fa6878", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442671, "uuid": "68e8103f-d4fd-4159-8d68-c4abd8fc77bd", "value": "51373c3a74c1d0eb8ecafdce7fd0d7c30f7afae3655a0f1f4b1d53137b51b36d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae55e878-9d5a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618429836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429836, "uuid": "4177badd-2ffe-4909-a605-f74b8e1d2082", "comment": "Malware payload", "value": "f56726e828eb8ef8bd0ee065fe73f745", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429836, "uuid": "5ef1f2c1-96da-47e0-a603-35e0265a49cd", "comment": "Malware payload", "value": "513ac0e36767e5b921f975018bfd9a76457e84ed817d732e3595d948f6d32bfb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429836, "uuid": "eff358a5-bd6e-49b3-b7e0-a84635048205", "comment": "Malware payload", "value": "c13828908a2a63174b0310d68033d3175bafdc9b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429836, "uuid": "94308891-a819-41b2-a811-cf1044d3bc3c", "comment": "Malware payload", "value": "8b356b9d3247f456f85de97e0d499d27825768c419844421611f9c876c736c53eeb5524611578c2603d75291085271b5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429836, "uuid": "e3435774-86f8-407a-b151-a2cf09b03cd8", "value": "18249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429836, "uuid": "73d9d395-5ccf-4a34-88ea-377fb1cba5b7", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429836, "uuid": "b3c925d2-e473-4eb6-900d-b169f2d63592", "value": "3072:B0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:UpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618429836, "uuid": "fe4d58d3-0f30-4bd3-a514-0345b3aad02e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618429836, "uuid": "37007596-f00b-4931-89e7-40a0248a591d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429836, "uuid": "2d6c34f8-00c4-4c41-8a44-b618c9f6e2be", "value": "513ac0e36767e5b921f975018bfd9a76457e84ed817d732e3595d948f6d32bfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e1ec3c-9d66-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618434821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434821, "uuid": "d4050eec-0009-445b-acfb-bfd70fc22265", "comment": "Malware payload", "value": "ba11a8ea3626d1159e06a253d0bd03e9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434821, "uuid": "4966f009-0f5a-466f-b897-ee26e1efc23c", "comment": "Malware payload", "value": "52f887ef2bee3d6dddec0115b7bc196ddc187cca4eb2fa884e91c716338c7540", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434821, "uuid": "ca48d13b-8295-4794-aabc-995a77fde77e", "comment": "Malware payload", "value": "f598a9007ac7abe42372753e72280d94c0696b7b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434821, "uuid": "00f418dd-4d17-4b27-bfb4-08f4e4604da5", "comment": "Malware payload", "value": "24d76a89d04b9d22505b308242078c90eb9f3c2e4f85b3ac293525847e557c549f36981fcd2718e3fb5dc1249b469642", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434821, "uuid": "65811c70-0f99-4d56-8638-c3130a14dd0a", "value": "C2249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434821, "uuid": "e966601b-013f-4f7e-b4ef-e2ae5f609204", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434821, "uuid": "0924bb5a-ed16-4748-80ca-dfe158c487d2", "value": "3072:o0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:jpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618434821, "uuid": "2dc7c94b-86b7-4241-9fed-3b20bcfc7e57", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618434821, "uuid": "f3064cae-7fb9-4f0e-b8e6-e830a9dd032b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434821, "uuid": "4acb55ab-e59c-4245-a9be-744bda95b5ee", "value": "52f887ef2bee3d6dddec0115b7bc196ddc187cca4eb2fa884e91c716338c7540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b28b3b-9d63-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618433762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433762, "uuid": "a55c5f15-f9dc-44ce-ae37-e964e75f081a", "comment": "Malware payload", "value": "c1cedba749461b2402cebf1f12819b83", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433762, "uuid": "1b778eb3-d5e6-4e7e-b553-161988344f65", "comment": "Malware payload", "value": "5442dbcf24f2407dbb747f20e9ebe2ae45de9acfc0af5d087b0d92e9cbf49985", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433762, "uuid": "af1f4b90-f61f-4d69-aa45-fda55cee2bee", "comment": "Malware payload", "value": "b7897d5d50205532ac0f409e3db7ae72594314ef", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433762, "uuid": "a071b881-4f23-416c-af6f-5518cdf7a004", "comment": "Malware payload", "value": "4cc98cf9c5736313c8f78d4dd9721a95e6153fd8fad02679e884600a3471e35e3f5108a13b745629fced9c498deb98da", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433762, "uuid": "c1fefee2-a754-4760-b09c-99af571d9fda", "value": "C6F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433762, "uuid": "4a6a7c8b-4826-4aa5-812c-ddf9d85e2be5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433762, "uuid": "b0db1a8c-4d6e-459a-a415-55ff670627de", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618433762, "uuid": "a731a55c-934e-4101-a471-a3cde39014a3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618433762, "uuid": "a0b3fa62-23b5-4ece-be3d-03e8e98479d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433762, "uuid": "533008ac-7003-4eac-a6ec-87307b7b7164", "value": "5442dbcf24f2407dbb747f20e9ebe2ae45de9acfc0af5d087b0d92e9cbf49985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01830db-9d77-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618442348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442348, "uuid": "bf5d58de-72ec-44cb-8f10-017fb976f29d", "comment": "Malware payload", "value": "62de1340412fb2193907bde675aaa8ea", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442348, "uuid": "35a3ee80-e984-406c-bf75-a74d2d00cc7d", "comment": "Malware payload", "value": "545a7985057032643abe040a0453902e4f31371369bc806126140bc83d397cbb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442348, "uuid": "0f824546-b56e-4aca-8172-c251410cfe1f", "comment": "Malware payload", "value": "926fbbda437fc5ade8dc83c6ef2fc4fc4678d851", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442348, "uuid": "81870e92-0786-4159-8b6f-9841864a07fc", "comment": "Malware payload", "value": "4a9d7bb77e43ba0de1574299add3c123eac8f7900d221e8f1fc9580df91d81438cc6e3de3d75cb51b416f71cb2d25dc9", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442348, "uuid": "1bb5887b-4dcc-4442-9d96-f43d9d8dfc3b", "value": "50249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442348, "uuid": "9f0a4ba3-6b5f-4bd9-88ae-1c6785479e8a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442348, "uuid": "296ba003-0263-4713-afa1-d3682736b185", "value": "3072:L0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:KpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618442348, "uuid": "a7be3bfe-c15b-4b60-ad17-b339ddb13386", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618442348, "uuid": "bf1ff913-7d70-4cb1-8994-40baf81cdaca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442348, "uuid": "012df877-5a94-4429-ba11-c7a7d740b03f", "value": "545a7985057032643abe040a0453902e4f31371369bc806126140bc83d397cbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c1f442-9d42-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419621, "uuid": "4e235c98-29a5-442d-8350-17fd6d0b1ce1", "comment": "Malware payload", "value": "8b8d8336bce4db7aefbbcb6697632a5e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419621, "uuid": "135baeab-b5b3-4dc0-8481-95d630f9f91f", "comment": "Malware payload", "value": "5491e66f130b506273ad35f05f32ccf89394077b1b006b129d1561e62249e1cd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419621, "uuid": "aff9bcc0-cb4f-463d-a7fa-ab3c4c901569", "comment": "Malware payload", "value": "141c55954f8920ff0c0f5d786b38910ab71a8c9d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419621, "uuid": "01e38a8d-96c3-4e59-a7f5-5dafede093f7", "comment": "Malware payload", "value": "2f23a11ca0b1d8140bba5805efd530d7d3811a6db2718df8752fef1ddf89b31373fbdb10f21ad8f219b6348aeb857eed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419621, "uuid": "c93b815f-50bd-4601-ac5c-d2eefc59cc9a", "value": "A4930228E6F25127DE75647FF6134DB22B1A3401B371995B3480849A8CCE5F386BB8DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419621, "uuid": "b2826aaf-e239-4d30-89e4-58ab36617553", "value": "1536:LMgmwe/goi7gPHjPPLIW+7osUJ4kfeeTE0hJMcPmaDpdSu19ihOWi:LMl/u7gPDMH84kGf6JMcuaNB19oOWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419621, "uuid": "80330031-950d-4090-92c5-4885dcfcbbde", "value": 96451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419621, "uuid": "76f90318-304d-42c5-a067-390440e415be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419621, "uuid": "f76fb75e-e033-4249-8ec4-6bcd621a4c0c", "value": "5491e66f130b506273ad35f05f32ccf89394077b1b006b129d1561e62249e1cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27dc182-9d42-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419562, "uuid": "db485524-80e0-4b95-807d-5ba8eda8630a", "comment": "Malware payload", "value": "53bce5cd89924db2e3730ae0bec36a5e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419562, "uuid": "3367e44c-e1d5-4919-8d55-ff7d8ee8f35a", "comment": "Malware payload", "value": "55aae9d778b3814962d93963c31401391a22cea7f84a412ce18f5370f8b78f53", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419562, "uuid": "33662292-9fe4-4483-b216-198765b8dc0a", "comment": "Malware payload", "value": "474788f5e37837c91e51b41b85adc7974e17eb50", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419562, "uuid": "ecfe824e-bbce-4dde-8ecb-524be76976a7", "comment": "Malware payload", "value": "9337c2f6bcfe5f8f0f79d11574b3e626089614dc2111f07622f3457c1ece8c9328ad89c4db436626226a256398080e4f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419562, "uuid": "b69c9c7e-60cd-43d7-829d-5d67b5296b00", "value": "7CF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419562, "uuid": "47c36c2b-d119-414e-8b47-a1c941b9f8f2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419562, "uuid": "ad6b1e74-849e-40d3-8072-1c4514c224b6", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419562, "uuid": "9b7aab43-11c3-4bda-b65b-c8ec8c41ffdf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419562, "uuid": "27945e51-6dde-4c2d-b757-cefd55845ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419562, "uuid": "2847e9c1-3d21-40c2-8b09-3f904d5d7020", "value": "55aae9d778b3814962d93963c31401391a22cea7f84a412ce18f5370f8b78f53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf5423f-9ce4-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618379285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379285, "uuid": "21a3b13e-9ef6-4643-8ef5-7259d1c7fea4", "comment": "Malware payload (RemcosRAT)", "value": "fba4deea2d7c1f21a67eaa84540e90c8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379285, "uuid": "6bf5f50e-8ca2-4e99-ad61-3021bf524f5b", "comment": "Malware payload (RemcosRAT)", "value": "5825fcf56bbf240896843ed163b764a4373e7ef8d8c282eaa76c82f2f94c8055", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379285, "uuid": "28c2a21d-2501-4f6c-8114-034e89f6ab30", "comment": "Malware payload (RemcosRAT)", "value": "a59bb0b7e2481cf6b2e556e622abd63d4e33c79a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379285, "uuid": "c4a261ab-7e00-4466-85cf-3f33db44b440", "comment": "Malware payload (RemcosRAT)", "value": "832732d8b708e7bbefc7f6f4f7b071b95063c711ea2751f40c162331ae0558e79b4541908e88d9610ad248e1df16a976", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379285, "uuid": "22bf40c9-ffc7-4020-ac6b-fb2e715d6ae5", "value": "10F4332D5C6A87E63275073BE6F4489BF02B7FA442DA762BBDC0BEA415056F1F242148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379285, "uuid": "f0c663af-9658-4724-bde4-75f964371fa7", "value": "12288:I6uN0Fmp2w4bMua2hNuEBqf672ff1zUOTvqJmPLqffZPanqT4faT6YRQA0TwJwgs:I6uN0cwwluaUBqCGf1d/4RPOqT4CGYiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379285, "uuid": "7349ab06-b32a-4020-b7eb-3139bfafdee7", "value": 779592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379285, "uuid": "1fcce977-47c9-405c-ac7f-baec88907a81", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379285, "uuid": "608b8831-84ea-4f8b-ba1e-dc6b78f65127", "value": "order (2275875577) sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc8d4f7-9d6e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618438287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438287, "uuid": "45696af4-3e9d-4fa0-bccd-12fa44fcf9a3", "comment": "Malware payload", "value": "3ecc40dc8d590e38ae6a4204770bc312", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438287, "uuid": "5ca9728f-5b05-424f-b10d-011e3a013389", "comment": "Malware payload", "value": "590ebb0866cc6fd0eb33a8e900639234e49530ee76440e7f5ef716dafbf1b504", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438287, "uuid": "5ae94321-dac9-4610-8fbd-913e4483569f", "comment": "Malware payload", "value": "8aeb76528d7f0726119161f29d813e0f28913cd1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438287, "uuid": "e400f278-6f15-452b-a2e3-ee6e9cbef82a", "comment": "Malware payload", "value": "5b63b62c2ab51f867719f8c42294e1cb426eac902484d5b6a318c973a61cbaf598de4adb8f4b84fcb18aa2c117b6db04", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438287, "uuid": "54025aeb-38f3-48b2-a063-2edd34d1f275", "value": "45249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438287, "uuid": "ba095875-281f-4bee-a258-8928e901cab4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438287, "uuid": "71e535fe-e3ee-477b-a727-048ad2a123da", "value": "3072:L0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:KpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618438287, "uuid": "11f6f8f3-ce04-4e90-81b4-fb94c13fffca", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618438287, "uuid": "050ac7c5-e3f5-48de-aa0f-0125d748c0a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438287, "uuid": "60758aaf-89a8-4fa3-99ae-2a3e932ee56a", "value": "590ebb0866cc6fd0eb33a8e900639234e49530ee76440e7f5ef716dafbf1b504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c8a5e0-9d24-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618406704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406704, "uuid": "ffbc1aa8-90e2-42ef-bf3e-d71b6b632c29", "comment": "Malware payload", "value": "2a96f40d6755b3738824f0d529dffcee", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406704, "uuid": "c9462bf5-6d98-4590-b5d4-25d7e3fb561d", "comment": "Malware payload", "value": "59f61e3f1770c4eaa7e4df3be6d7424e5129349cbc521fbf3d64e88bfeb6b811", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406704, "uuid": "da966c61-ad32-4ae7-a522-c628eda8b7e9", "comment": "Malware payload", "value": "f7c85ec63879f16ecafb8f7ed576db37e444d398", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618406704, "uuid": "820a2767-8b1a-442f-b54c-81c28af3cecc", "comment": "Malware payload", "value": "b62a0a8e5d7976aa41c6753877823bdeb7cfad0905531472ce2f0d538b4e5a8ed5578a58ee0a19ad7e47f7c8a77326be", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406704, "uuid": "88e8cf01-1097-4707-8a20-395b89a632f9", "value": "A6D42312E97463A9B0E00A4509FC7E79A30658EEFE7F15F3E20B670959E447EDF1A084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406704, "uuid": "3f222f00-4f07-478f-bafb-d5371b273de4", "value": "12288:7AYNZhMt1Hy8DPIbWvogvb5PRl/axmoQeQgm/dF6:7AYRkDwejlSxmw4/dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618406704, "uuid": "5e58b1d8-96a9-474b-a45f-106bf7e1613b", "value": 643111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618406704, "uuid": "752accca-3fd1-41b7-a928-2560362cc2e8", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618406704, "uuid": "08aaeadd-0c15-4e9c-8d88-11e4689e744c", "value": "Oferta N 12100877.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928150d9-9d71-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439667, "uuid": "ec75b836-16b0-422c-aec4-c9eded57b909", "comment": "Malware payload", "value": "851e908cc0ef8ab19defa94644957e1c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439667, "uuid": "3abcb41d-6f14-44c8-9b79-2c8e337f1937", "comment": "Malware payload", "value": "5df2e040b7c3243e26ee577aab70386da82d4ea9044ad9aeced52253ba224217", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439667, "uuid": "9e588e5c-0f06-4762-a72e-4aa5a96df36b", "comment": "Malware payload", "value": "57260b5b2cfae3ae19c76fa2b0d8bac904f4f3f6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439667, "uuid": "2cc14f55-214a-4818-9d11-18e62a64182c", "comment": "Malware payload", "value": "28798e1d615bbe291b9463aa218c10114e436a763950a730a28648d9d1afb62e04d502efd835df5f3ec506d9f0e2f9cd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439667, "uuid": "0f572b68-fbae-499b-afc8-65fe6aef9709", "value": "D9249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439667, "uuid": "919196ed-98aa-4a64-8a84-a1a36e403000", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439667, "uuid": "126555e4-ca12-43ee-9a26-57bc28f41e76", "value": "3072:A0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:7pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439667, "uuid": "c3f0cdb1-ed75-466b-87f2-3f792f245163", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439667, "uuid": "bfb747bc-55c7-4213-bfe4-5bcc36eab7f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439667, "uuid": "b4bbed65-e8d3-408c-87b6-6bfb450bb587", "value": "5df2e040b7c3243e26ee577aab70386da82d4ea9044ad9aeced52253ba224217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90be55c-9d55-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618427760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427760, "uuid": "81ba2ec1-3788-431f-a518-c2ec3605f62c", "comment": "Malware payload", "value": "a6a0774f37964fa2facf867c50a82556", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427760, "uuid": "da8fc5ae-20b9-40ec-a76d-87d9d26a1c52", "comment": "Malware payload", "value": "5ecb9d3b55f6d0aa1b41c15585c78f0b40c65e8a9cf221d383011c2cd3017a8a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427760, "uuid": "6879c93f-50b7-4934-807b-63fc6d1511e7", "comment": "Malware payload", "value": "8130f832eb0a6ec9da370ad754dd3ae5070d1be3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427760, "uuid": "e99a9214-ecd2-4aee-bef7-dd79e2f5efba", "comment": "Malware payload", "value": "35204235994038508b87e22db0ad94f199fe7b824b3bb6bc5da98ea8338f9c872a3804de95b99056e52333681c73bc9f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427760, "uuid": "b74b8d92-a157-424e-84bf-88b397c1a49c", "value": "99249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427760, "uuid": "a8a4b3ab-f4c0-45db-a1cd-831fb7b71bc1", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427760, "uuid": "beffd9ec-fca7-476d-a58d-4ee60c8cbb18", "value": "3072:G0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:FpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618427760, "uuid": "2a0a4957-a2be-4903-b966-51a073618868", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618427760, "uuid": "5e823af4-e54c-4203-80c5-597bb077b6cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427760, "uuid": "70fb97bc-1e08-44f1-86d5-faa3dfac2a9f", "value": "5ecb9d3b55f6d0aa1b41c15585c78f0b40c65e8a9cf221d383011c2cd3017a8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea6d6ce-9ce2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618378297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378297, "uuid": "d1a2f918-f317-490e-980b-fe8124a363c7", "comment": "Malware payload (Formbook)", "value": "ed96876c66f33070e5275861bbf692fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378297, "uuid": "242ea12e-5402-4195-a697-c34446c7a5ef", "comment": "Malware payload (Formbook)", "value": "5fef6e5e702f6ac33542c50d34d3054d1b957c3afd5dffc8fbeaa81d82fdf562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378297, "uuid": "72d204e0-9e43-448d-849e-1f1fa929edfe", "comment": "Malware payload (Formbook)", "value": "d44764c3053d0f47cb4e5d470d8a05ecd182320f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378297, "uuid": "6c8aa6ee-ef3d-4ede-9f7f-e05aa8c5690f", "comment": "Malware payload (Formbook)", "value": "195674c9a5fb588b71f2bb8a858bf376fe213078c892af443f4934477324f09e933d3911531bac06f05a2d8b6be79f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378297, "uuid": "00d23a05-e6f0-4a1e-9127-b2fbd549d691", "value": "262413463694ACF7E6176F300D739775C6F3D2822529C6578BC0AF3F7E62A42E129221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378297, "uuid": "d94f74f7-a0b6-4320-9ae3-7761612bb7fe", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378297, "uuid": "3cbbf76b-7a96-4a7f-a925-504dca505a4f", "value": "3072:HyewmN4skJ6lFEEbWQkN6+RhdxQ16JxX6xSkHAulX0arWhP0p81DbfOWaFVYOSv+:Hd3xylV01CxhkHASU8pabW7CK/5RNdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618378297, "uuid": "a14bb595-3a4e-419c-9b10-20195a7a736f", "value": 227337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618378297, "uuid": "eabdb22f-c81e-48a5-9f2c-01d711f4ded6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378297, "uuid": "2b59c316-7042-4159-b56f-a704d004a501", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7513ad17-9d74-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618440907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440907, "uuid": "634b3614-d75f-46c4-8b6d-d9503dcbd529", "comment": "Malware payload", "value": "d70a5bead47bdb241ea9d6b55449f2c1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440907, "uuid": "794b3b0c-36cf-4f4d-9bd4-61f0e84849ca", "comment": "Malware payload", "value": "6085d0371d89b41304a6f41eb68ae5a59ad6c3095c6e67dd17ceb4317a604519", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440907, "uuid": "ffea80a8-b251-43f8-9f66-819b4e2e2c4f", "comment": "Malware payload", "value": "701312ceade417d686687db748237d3c1bf4d98d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440907, "uuid": "ccd45f27-e9d1-4e61-a8b1-60181ede7d2d", "comment": "Malware payload", "value": "189393c2d7836b741d4eec9f862a7fa6393b459c50b1c54f82ba3d3c3664f03dbedfd00b3d2e5de97a6ceb2f2cca7578", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440907, "uuid": "321a87ee-17bb-463f-ba71-247c57d8788a", "value": "E7249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440907, "uuid": "5c6656d7-39ef-45c5-9fb6-0dab13b81132", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440907, "uuid": "f3514512-74bb-4e1d-b257-e9bd5ecbb63b", "value": "3072:o0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:jpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618440907, "uuid": "4bd866ac-ecd1-476d-a97d-7cf94aee4407", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618440907, "uuid": "fdbec0df-9ad3-4bd4-9f17-d4b2f7da96c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440907, "uuid": "5519ee9c-5adc-48d0-bfe8-ce766993401d", "value": "6085d0371d89b41304a6f41eb68ae5a59ad6c3095c6e67dd17ceb4317a604519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89b99f4-9d77-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618442362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442362, "uuid": "1319d852-622c-4e42-aa6c-6ef27bedc3b9", "comment": "Malware payload", "value": "a52644114b893bbbf5d1a6f1e33401c7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442362, "uuid": "82bd80aa-3b63-4b55-b38e-7b67826980bd", "comment": "Malware payload", "value": "61c16d57a2ce67ef9336caef4714d140d5f071ef63ca503b87c5790185eae952", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442362, "uuid": "7b73e243-b31e-4d36-a182-38c8ee35b9cc", "comment": "Malware payload", "value": "a1c915f306286869d8a5b0bdf4df441120e921be", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442362, "uuid": "be4f800c-7c96-4912-8e0a-7ca72bc2f9c0", "comment": "Malware payload", "value": "a734921167a372acb60e9683fbda4e1dc358ec8b4b58c0eef36ae6da470a5cca49dfb1e1927130b58186bd4721bdbaee", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442362, "uuid": "9f3c8adc-8c7b-4bd9-87e5-7ed5f0e05a22", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442362, "uuid": "de0f0b5b-4326-4773-9554-348524b3f1e1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442362, "uuid": "9debff6c-b75c-450b-a834-6b7591533797", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618442362, "uuid": "90e86f23-5066-4ecd-a117-df436a2c1798", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618442362, "uuid": "a236a2fa-10bf-4538-aaa7-77ce8e6e198b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442362, "uuid": "d3f4db09-a01d-4480-bf94-657dffffa8fa", "value": "61c16d57a2ce67ef9336caef4714d140d5f071ef63ca503b87c5790185eae952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32486c1-9d66-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618434971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434971, "uuid": "9712a106-1cbe-42be-aa36-8fcac4cbcff1", "comment": "Malware payload", "value": "2bd4391d674f91ca31486fc29bcc8395", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434971, "uuid": "736b962b-cef9-4c0b-9646-336e482d0213", "comment": "Malware payload", "value": "61e08992246a8c724122879d9d3dfd93b929b61d4298f4191719cfdbb9d7cf66", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434971, "uuid": "9ee327ea-0254-409d-8d43-1cb2d5c60e9b", "comment": "Malware payload", "value": "a169423097cfaa55aeb637e96b78f11b2a9c2bab", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434971, "uuid": "c67643dd-da4c-441c-8e43-a4b798332dea", "comment": "Malware payload", "value": "07140307a773e71816d0c17e235ea914df6c4a51d1db17d74181f9df8535f019d36472d1ae6dc4a447942c97361eae2e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434971, "uuid": "25418277-1439-4c82-980c-1728c1b37161", "value": "75249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434971, "uuid": "7c67fd79-b5a3-4be1-ac80-ea67ded1ce71", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434971, "uuid": "39869c7c-8453-416e-a3da-efee6e087d4d", "value": "3072:r0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:qpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618434971, "uuid": "ea1f4183-f036-4401-80e6-145e22cd744d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618434971, "uuid": "a13fb543-ce91-438b-be5b-f1e4cb08800e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434971, "uuid": "3ec1b9c9-3f4f-41dd-8116-98be41fda537", "value": "61e08992246a8c724122879d9d3dfd93b929b61d4298f4191719cfdbb9d7cf66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278cbe80-9d70-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439059, "uuid": "e3955c1a-1f7c-4d5a-845a-77bda565258c", "comment": "Malware payload", "value": "fa8f1fe6f9b0a655e3057de480ae9b45", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439059, "uuid": "b4dbc9ea-a9b1-416c-ab7a-48b195e73f5f", "comment": "Malware payload", "value": "61f6ae3648ea8ba2798729ca8cbb310ad4629857ccc458122b7d7983b7fab4a6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439059, "uuid": "88b15533-0d48-47cd-a973-5d994c01e634", "comment": "Malware payload", "value": "ae6ae7a2740476a0c1845a01c1e69d277dda2962", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439059, "uuid": "9ba9eafd-bd2d-4a7a-b957-5e8554e227f4", "comment": "Malware payload", "value": "e7385fd5150f058d109862d981dcd2333e0e0a4e0c91bb722e9f7060c7deac927b6db578b5f66b3ff25ba99eb353dd00", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439059, "uuid": "60871ea6-2175-4ab7-bb23-4e87e777f335", "value": "AB249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439059, "uuid": "681e8b0d-cf29-4c34-96cc-68c591d1cee1", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439059, "uuid": "4d351504-bb87-44ac-af43-332c2d4a29d5", "value": "3072:O0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:NpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439059, "uuid": "f4538574-3347-4f2b-a493-635aa0a81ddf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439059, "uuid": "324a2ada-b5ba-45e3-8776-ed18b7fdd77f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439059, "uuid": "d5a3a643-5c24-48a2-945b-3e96b8ae9742", "value": "61f6ae3648ea8ba2798729ca8cbb310ad4629857ccc458122b7d7983b7fab4a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682554ee-9ce1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618377749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377749, "uuid": "8e08169c-1647-4d30-9fc5-1e02019d6162", "comment": "Malware payload", "value": "f05e486604e7586049731dfa01a5e4fe", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "TSCookie", "colour": "#EB73A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377749, "uuid": "8b914b6d-f69c-4153-9b09-373002c055f4", "comment": "Malware payload", "value": "638cfbe609d7f3e88767133be5ea5f9a75f1d703275f38eb9ec2414e179483b9", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "TSCookie", "colour": "#EB73A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377749, "uuid": "a6d2466e-b01f-4339-8d5e-6a771dbc0eb6", "comment": "Malware payload", "value": "fcd6ba3f2f85060ce9b26edff441db30bf3ad967", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "TSCookie", "colour": "#EB73A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377749, "uuid": "8335f1f8-d0cb-4b9d-b3a4-c48de7872f9e", "comment": "Malware payload", "value": "a59d4781bbe574c22facff108fbaf0db8a5be818d04e365c08288aad8617e29bebb1f9882d1d4fae94ca92a705f4379a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "FreeBSD", "colour": "#75A699", "exportable": true, "hide_tag": false }, { "name": "TSCookie", "colour": "#EB73A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377749, "uuid": "33088b94-09f3-426c-8433-2b69eab19ea3", "value": "FB155B05F98760F6DD061931508FF33F4931A61EC4329EAACB95DDA1EFAB632310EA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377749, "uuid": "7f3c8708-42c2-4cfc-9b93-5cb0b36b3117", "value": "24576:NR7Jf1sogFMgRdHHVpXMQIXSFQNEEdn4WOgR:NR7JdsjnrMQIZa0PR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618377749, "uuid": "10ac7632-afa8-4f3e-baaf-4e04fa91ec13", "value": 884308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618377749, "uuid": "aa2fba4f-c215-40a3-896a-d21e9b6e8157", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377749, "uuid": "8320079f-d552-4a05-b412-651880587f9b", "value": "geom_etc.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d9fd47-9cb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618359891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618359891, "uuid": "e7b282c3-0c3d-45a0-ab1a-7bb4b7398127", "comment": "Malware payload (Loki)", "value": "8dd74abe89e46cb706fb68b5945adc73", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618359891, "uuid": "1a00c1ca-e542-43da-90fa-3bc057673131", "comment": "Malware payload (Loki)", "value": "63b795caa8ff26d971a08bf7ed0a6f033ea91f15ecafcdc14d5ff14d414ec5c7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618359891, "uuid": "d341b3f8-46c5-490d-a040-d57bd90f302c", "comment": "Malware payload (Loki)", "value": "c0df6290825dc9b67d0973e86fd77bffc5d1f200", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618359891, "uuid": "fafde180-4a49-4a53-886f-ffc9fd8fa962", "comment": "Malware payload (Loki)", "value": "cc5aeb11de9ec284bc15a8e175e22da671afee246d902a17e9151b330d5a97d06ee7d6cd6142039ec830b3e16a3aa024", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618359891, "uuid": "74f91a6b-ae22-4875-bfb2-d8cb43b8c24c", "value": "F3F412ADB2884A7BC47D62F511C0E480133142D63692EFAD9DD1A3ED85F6FD078512EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618359891, "uuid": "578238c1-bae4-4965-ac38-c548186af106", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618359891, "uuid": "4e251c08-c318-41d5-a279-e2145b63c299", "value": "12288:Qa8Cym567VW2iNZFhtSf+5Xa50dSic5oneRiJjLRNCeUsdpCenbdwLCmMlF9pH/h:EQ1XFhMf+w5epc5SisavsdprhWC5fNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618359891, "uuid": "9767f321-bc17-43fa-84d5-ff778a5dccfb", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618359891, "uuid": "8d9f9676-9bad-48d8-a8d4-11e8a4ba65ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618359891, "uuid": "e2993887-4fbf-4936-a76e-290c6338da65", "value": "New Order 20211304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc9b3a8-9ce7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618380226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380226, "uuid": "4d660483-bfc4-4f16-b824-9d8d890243b6", "comment": "Malware payload (AgentTesla)", "value": "881a7a8fa8f9724fda48c4d28447736a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380226, "uuid": "3567157f-c96e-4db5-bc47-b6d49da4ac0f", "comment": "Malware payload (AgentTesla)", "value": "63c90157f0f1407344cf4b223ab28a584b259dd8faef779efbdfb1d3b9fcd144", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380226, "uuid": "8ffb98ca-d4ac-4507-8d66-8018a922e000", "comment": "Malware payload (AgentTesla)", "value": "a0765b90f42b7b4fdd792ce0845fbc6b0ca5e1d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380226, "uuid": "87650884-3643-42c8-9d05-4fd84700491b", "comment": "Malware payload (AgentTesla)", "value": "f9331b16bf0b5a78159f9c5db7291a57eb19d3f17439d836e578f0c805940d434cef513a0bc13e0eb76d9e1167998fcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380226, "uuid": "3d712dd7-275b-4294-9162-57d621331ce5", "value": "AEE433E5FC7B49A27143E1AB6D7235E6123352073D0D9F263A5E36A02EC71829FB0572", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380226, "uuid": "7724f020-b3b7-46c9-9de1-00521d6e4c7d", "value": "12288:XTNQ3IO3klkmjih3tUPuwDFHI8oqe+DF23RJxLZcSpciIIcNOaK2qIc48qkCxkmA:XB3OObjih3emIHshe2hJfl0OaKiGCrCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618380226, "uuid": "e518c1bd-0b3d-49d9-9b49-20e908927f00", "value": 680224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618380226, "uuid": "fd5c8cc4-9eb9-41a6-8655-c7ed991c8d77", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380226, "uuid": "a3b4425e-8e92-461e-9ddd-417b2184b703", "value": "Consignment Document.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18d6475-9d58-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618429036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429036, "uuid": "195438c2-823b-43e0-bd5d-58159c6c1e7f", "comment": "Malware payload", "value": "08aa990f3e0ab2e89f3c03df05163813", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429036, "uuid": "c58d38d9-5854-4128-b67e-f706b4b43e3d", "comment": "Malware payload", "value": "6416b204cd68806b9522a4e5e12b665b8e343b096ab58f5b66e0004d75e77013", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429036, "uuid": "ab1b291b-8ddd-4c7e-a8ce-42794256a9dc", "comment": "Malware payload", "value": "9c146e24a218db786efde558d8e842d82db45931", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429036, "uuid": "d2bb51b6-6e56-407d-87cd-dd054a07fc4e", "comment": "Malware payload", "value": "318132969f866d14fec40a94e485bd9742a474b11282e1cd99a81fca2ae54f4e4eb2498d9b0352ab7b1a45c0b0aca5d8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429036, "uuid": "e128fa1a-cfb3-462a-a79f-e3c21ccbc0f9", "value": "22F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429036, "uuid": "02d18c33-ebf2-478a-b854-bbf935a3eaa7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429036, "uuid": "5ff6edf6-e0ab-4407-b5cb-c1317a27b83e", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618429036, "uuid": "7b5af3f9-76c0-4cff-b326-c6f277b7e028", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618429036, "uuid": "5551bbf0-28de-43ed-8c33-5efccac73deb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429036, "uuid": "e3640229-ac99-4ba7-9316-bef5a5aaab6f", "value": "6416b204cd68806b9522a4e5e12b665b8e343b096ab58f5b66e0004d75e77013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f36721f-9d59-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618429220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429220, "uuid": "d188b500-afd5-4a15-8fcb-36f183450ebe", "comment": "Malware payload", "value": "d6b2988df267204b594be8e235e85b1b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429220, "uuid": "f6be5071-22ac-485c-beb3-9701d5e4cf6f", "comment": "Malware payload", "value": "643c4b99fd56e2ffb512d2ab5d70dcdb0507befdc2c24dcc48a4269814be96e3", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429220, "uuid": "133eb8fc-a4a9-43b0-a4ec-407b969b411b", "comment": "Malware payload", "value": "546cf730387991268ca711c331caf0b46e879a4e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429220, "uuid": "8c1244ff-6146-45a8-923c-402054e152fc", "comment": "Malware payload", "value": "2840a339c00954b72e866b789be69c9efa6a405fb46babf6f4d8a627281a30e963bef91db38915475bcdea919fac6d60", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429220, "uuid": "f45094ba-0613-4b79-8dbf-13145bcc2f6c", "value": "28F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429220, "uuid": "80d435e9-630f-4fac-a151-2bec720ab88b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429220, "uuid": "18b73b9b-7e3b-4d76-b69a-053c97ecc613", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618429220, "uuid": "3fcda8d1-f690-43f0-95ab-71bf8a012856", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618429220, "uuid": "02d3a0aa-f012-47b9-8169-7e3d63a37e8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429220, "uuid": "ce053f2e-8364-4be9-95dc-7e5f8b036bd4", "value": "643c4b99fd56e2ffb512d2ab5d70dcdb0507befdc2c24dcc48a4269814be96e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b77993-9d44-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420456, "uuid": "5e152ce4-d925-4644-897b-8aab1ba39faf", "comment": "Malware payload", "value": "993abb92434fa1966dd4f9a762e58405", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420456, "uuid": "84cc5a6c-0183-482b-acb8-3adbb5b3762b", "comment": "Malware payload", "value": "644b7915ae0ddc91b888ae8a5b93d5957dec2cf332f4e22e13360a1e468de60c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420456, "uuid": "661cce83-8f1a-4d61-b815-226939c8d8e8", "comment": "Malware payload", "value": "4b3b7b2b63fd9d79f54213115c722bf330092d65", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420456, "uuid": "2590482b-307a-4e15-a31c-91caa48d8928", "comment": "Malware payload", "value": "ce23cb0cf41034f1b8c73ebfceea8cc741805589dea90eb4b8feea27f4ae66ab180b09a4e6f7f8145517eb8ac6044d86", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420456, "uuid": "fe622230-a3d5-45da-bbf2-d6a5c0fb42b9", "value": "C90533CEC380E3C7555766FA0BED2CF2C05F448065E627FDA9C5AA3F4181F59AA6A310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420456, "uuid": "cf0edd30-1992-4c5e-9707-ecca574a4850", "value": "24576:+Gx4WId0CnBjXC6zRoGCLmJJmr6e67/n2y2:++4X+gjC6FoGCLp6Diy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420456, "uuid": "1abbf19a-0f23-4adc-b2dc-67fe0c248e9c", "value": 831499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420456, "uuid": "2c7986a0-a977-4d27-b457-b3dcacb77f24", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420456, "uuid": "d81acf80-48c5-4204-98c3-e60f35b203ba", "value": "HL-88352588 DOCAU BC ORIGINAL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356e84a6-9d7c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618444236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444236, "uuid": "9027adbd-ee3f-44fc-b353-379aaa05926a", "comment": "Malware payload", "value": "ecbe5b4d74bfbcf0a0003ed1ed98bff8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444236, "uuid": "847764fb-1310-448e-b66c-d15569a59719", "comment": "Malware payload", "value": "644e074fbd757fca231cf75a68b2aa870aedc2835a9b4fb1df14a35afcffca5a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444236, "uuid": "e8804958-63c8-461d-a057-fce75ce11b47", "comment": "Malware payload", "value": "a1f8b0c91a516aaa00d2057159306d8f5e4ce55e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444236, "uuid": "51e0e279-e416-496a-a248-8799cf15cb7d", "comment": "Malware payload", "value": "7793f887bf404dac7054e0fbd1cf6cf0aa39bc781c53ec8b1341951347d6e0e36ceb4bc2f09bfe974dac3358d46bfb1d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444236, "uuid": "f703451d-1081-48fd-9bb8-6c53844f5898", "value": "95249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444236, "uuid": "87f1546e-3220-4a8a-b578-7dcf8c605139", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444236, "uuid": "8c7a3c53-12ba-4914-ab90-9bd8dcc9de7e", "value": "3072:W0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:1pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618444236, "uuid": "f6e3c3fd-845c-42fd-a7ca-03a05ccc93f6", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618444236, "uuid": "fecce68c-1f81-41c9-b418-8e633e8d2910", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444236, "uuid": "649443fc-bf15-4228-b1b0-2050ba212d9d", "value": "644e074fbd757fca231cf75a68b2aa870aedc2835a9b4fb1df14a35afcffca5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0079590-9d22-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618405867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405867, "uuid": "69bcad38-4a47-400f-bf6d-7debce9179e6", "comment": "Malware payload (SnakeKeylogger)", "value": "34458c052aff7fffdb177fb524022c15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405867, "uuid": "c99d45c4-3fe1-48ff-85a2-6f7641fbf4b8", "comment": "Malware payload (SnakeKeylogger)", "value": "64a17ddefb0368f4512f3d89fabbb0e220f80d2febd28b21fc4262779ceea635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405867, "uuid": "4b025cd4-37ab-4e54-abfe-dc8f2777ae2c", "comment": "Malware payload (SnakeKeylogger)", "value": "39a536da402db8e2c37ff5aaa6efc6e668af5618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405867, "uuid": "0c8b83d7-a8b1-45d6-9a6f-498e08a32c73", "comment": "Malware payload (SnakeKeylogger)", "value": "02b75c58faa3d257f81f6b88cbfb162c5db6a4a426bb2ca21da644baee185d07228108a0b11db2dafdaebb9a9b73383f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405867, "uuid": "e58774e8-21fb-49a0-9acc-7ca1c840e015", "value": "47F40161699CFBABC91D17B5C01081B547B792A3D385EB4FEC8D10C84AE1792F99C2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405867, "uuid": "ea03fd30-9407-4840-a91e-41d4fe5cfa17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405867, "uuid": "2f630899-ed77-4dc8-a10f-1a9dbf8413b0", "value": "12288:8Z84BuRAqcjbsQrrigfyEe2WNs8x6HrYrEnN:U8KbH5fy9t6QwmuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618405867, "uuid": "ed901a89-73db-41d9-b79b-375dc6e06ec1", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618405867, "uuid": "124717cf-be41-4e4a-b25f-ee04df76f824", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405867, "uuid": "9473c79a-59f1-4c1e-8aba-79eafef60808", "value": "DHL Waybill Document.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82186f83-9ce9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618381228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381228, "uuid": "7ab6ec9d-6411-4687-8446-e6d18c42fe08", "comment": "Malware payload (AgentTesla)", "value": "1689c83a277eff17291049d60dcf2996", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381228, "uuid": "ef1ea005-3441-4e13-98d3-11d5c7093afb", "comment": "Malware payload (AgentTesla)", "value": "657e0fc67cc6b147ca3aa5eff269c59eb80cd5dbf91e46d452d0e10bd6b8df75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381228, "uuid": "f3e43cee-09ab-4a22-b554-dee4fa4e703b", "comment": "Malware payload (AgentTesla)", "value": "031d047b8938a4082c22e26fa31608f314162039", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381228, "uuid": "277f1d28-17b6-4483-8ab6-8c35acc61b1a", "comment": "Malware payload (AgentTesla)", "value": "91cc53ef4b1c32025bcb3a91849b22227e704f6d9da5228f054f8d93449987b1645f0bac60987be4ad89e5d0825a3d47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381228, "uuid": "048996af-e96c-4071-a98e-e316ff9f115b", "value": "AC05238D540FDD870E85A8BC2C2A2950389C7D8AD355EA3D332F61CDDDB5F08927627A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381228, "uuid": "a6f4598d-e1b5-4e12-8ccc-3d1a6697a7f1", "value": "24576:iKd8UyVK2KPkIjpw3jVYleoxDMwHSWnmldDaCh:iw8U+KBPLjeeleSDMySnlxaCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618381228, "uuid": "a4755edb-e8e9-40b8-8b08-a5defaeb328a", "value": 851602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618381228, "uuid": "1588f2ad-f236-4705-8081-44cefcf703a6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381228, "uuid": "38e25eb0-1537-48c3-b383-40e175875298", "value": "HL-88352588 DOCAU BC ORIGINAL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16979f63-9ce6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618379760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379760, "uuid": "1b3f1f18-d230-4c1a-9812-922006f9fef8", "comment": "Malware payload (AgentTesla)", "value": "a7a69d13c5ab55add1a46cd3c5d05a3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379760, "uuid": "29fb7f01-c67f-44bb-8033-eb318a4bf580", "comment": "Malware payload (AgentTesla)", "value": "65958e93f816a135903aa6391c72a82f8d62cafc45dbc09913ed219cc62accc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379760, "uuid": "b2561b81-5049-4d58-8c99-e9e39f40deaf", "comment": "Malware payload (AgentTesla)", "value": "0660aea4bf327fa634061a0e3f9c3b2ef5d6f74e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379760, "uuid": "ae47c8c1-eeaa-47e8-a228-c9c62221a4a0", "comment": "Malware payload (AgentTesla)", "value": "7cfeb376491cadba1bbdf50bb834ace84106576e5bdef7b527a9f513af4fadda2f9e50ea07f9ba03992498c1f7b80e0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379760, "uuid": "57c8383e-a516-4df7-a90d-1c8dceaf1376", "value": "BB158C1323D56F09D33D8F729462E020DBE4EE0B3D1AE7972DC81DCB71BAB219511A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379760, "uuid": "8bc74c3f-1bb5-4547-98e6-7583389b40a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379760, "uuid": "ed8c0789-0a16-4a9d-8f31-df8757a27756", "value": "12288:auEbQOy4EJiZxG6xutjZrBocw5WEQcz5ZuF7UE5oK9mkV0rVJrgKzWjN9YuxpMaV:GyJJouttWWbiPuF4wmo0p53zwN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379760, "uuid": "e0815c8a-08b5-4941-ac30-ad78ef6729e5", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379760, "uuid": "0bbc4f1a-4da8-403f-b555-bad4f1458f39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379760, "uuid": "4eec189a-be73-4bb4-9155-e0a6b75c173a", "value": "PO,Order#4500484210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48199071-9ce7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618380272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380272, "uuid": "5cc2c452-df2c-4084-bc1a-02ebd1216a74", "comment": "Malware payload (AgentTesla)", "value": "e02d547d47ab803a24f8c9118a68171d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380272, "uuid": "e6466494-5158-4741-94b5-ce09e0b3d53a", "comment": "Malware payload (AgentTesla)", "value": "6602c8f5157316cd496003331465e222e236544c01b2c905bf9649bbded1fbc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380272, "uuid": "f4f051aa-7e0a-4266-8c60-bb9391f39888", "comment": "Malware payload (AgentTesla)", "value": "91dec8dfbd0fbfeb7d8a823a6c6de5e905c66109", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380272, "uuid": "e69b7f37-81e0-4513-bf23-da45a8c8414a", "comment": "Malware payload (AgentTesla)", "value": "e1c7432bcc518af4c7a9137ed2632f948ea5ed94e1e9e0d794c8b9958a6c883aab618ef9a0d33b3a89096185f639b67a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380272, "uuid": "42cd7045-297f-4dfd-8d8a-f4126bbb6798", "value": "05837C259B841936DC3B0B3AB4B168009B33B26745B3E62F349DE14A8B9338515F9F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380272, "uuid": "180b8fb4-2342-4b86-aa48-ed63bb263214", "value": "384:xiQpS+6eMBUVwlI646P00K9ajVPGX3p2mp2vyRehA:x9nEUHPx0K9IVPGJ2mp2vhhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618380272, "uuid": "e6f44fc1-9a5f-48a4-af3e-0534e1f3bf2d", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618380272, "uuid": "4ba2b92e-ae56-4597-9fee-43212ead70f9", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380272, "uuid": "cc1dd1e8-3bc4-480c-a544-96353cc7e1e8", "value": "Request for quote (RFQ).iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2aea014-9d3f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418327, "uuid": "1b4186f9-ce1f-4c66-9de0-68f9e6cb897c", "comment": "Malware payload", "value": "08a68ceecd9a5c8f158b9475f404b3d0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418327, "uuid": "b42f5fce-9b77-4ab1-839d-e03ede9949ff", "comment": "Malware payload", "value": "66f0ff25e2493507f4533129c38b9d99f5eee0e50919cb7e7ffc0f9b39dade85", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418327, "uuid": "26eccb26-ae93-46bd-8ae4-d938c428bae9", "comment": "Malware payload", "value": "8d836e3f9e1ebb72e79a96e0ad719a43cae735ba", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418327, "uuid": "89845001-7755-4b3a-9e84-c7c2d96c2f6e", "comment": "Malware payload", "value": "360d4d9248cb765c9aadea81d6fba7f227f76bfd92348e8e79353947736b83d546271347c8675ff3099eb9fc675281c4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418327, "uuid": "637c0108-6348-4883-bb4d-89ef52911994", "value": "D2249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418327, "uuid": "17c7eef1-5ee4-4af2-8d92-3a367a4023d4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418327, "uuid": "08686fcc-39ce-46dc-85dd-63806cdad22c", "value": "3072:G0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:FpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418327, "uuid": "034bc29d-f73c-4dde-ae84-8980addf9456", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418327, "uuid": "d5a99984-5df7-4443-97b3-43150b89abda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418327, "uuid": "cfb93e51-d6e8-4c15-acb7-69de4bbfee0a", "value": "66f0ff25e2493507f4533129c38b9d99f5eee0e50919cb7e7ffc0f9b39dade85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfba2173-9d6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618438884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438884, "uuid": "5a4e2ed8-8ac4-4af5-8627-cb4723d45f12", "comment": "Malware payload", "value": "5c7e0a7184fadfde0d79cf84f581f5e9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438884, "uuid": "a69ffb80-ed43-418e-bd63-d4773758ee8f", "comment": "Malware payload", "value": "6716a3b04bc447c783b07abe9a92ff841164dbee0b572995b95f8b3c399d218c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438884, "uuid": "2ec4015d-429d-4b68-bd39-7bf9828b3a85", "comment": "Malware payload", "value": "6f1c6dc5dfd819775048528af4bb4c8ba079ed6e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438884, "uuid": "b5c75e2f-e721-43c7-81e7-f0dd80688fd2", "comment": "Malware payload", "value": "bd167849bc3bbaca11ef669701eed023bd59ce2faac1c540e1a8fd55aede3e00e968a1b92c1b73b7e7d43ab9598442f1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438884, "uuid": "489666d1-031f-400b-865b-d3cd61fff8b3", "value": "22F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438884, "uuid": "1e64e487-689a-4576-8928-ab09ca349b78", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438884, "uuid": "ef3c3a81-4541-427f-a5ce-9c9980ff44d7", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618438884, "uuid": "19ab2129-81b3-4e23-b57f-b22d2497bdd0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618438884, "uuid": "2fcaa64c-5684-4be0-a667-4d3292cec078", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438884, "uuid": "20141321-ad4a-4804-bbc9-573fc55afabd", "value": "6716a3b04bc447c783b07abe9a92ff841164dbee0b572995b95f8b3c399d218c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f07fe9a-9d49-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618422428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422428, "uuid": "6f0ee1da-8199-4bb4-9afe-3e18ba70cc17", "comment": "Malware payload", "value": "3e93e06f20787fa0348f4b4776d084b5", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422428, "uuid": "cbd6f84e-cd9d-4b4e-a899-307ba6c5f016", "comment": "Malware payload", "value": "67f1b1a0f57b543d90a81478650d3fa1de0557eafc672c0fc38f6068a6e84387", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422428, "uuid": "e5e16b60-8eda-45c4-b300-32df9d97fd1d", "comment": "Malware payload", "value": "008e45dc8f8223d6f51db5107e3fd63ddaa57e6d", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422428, "uuid": "63600758-9766-4965-b574-2478c16f9439", "comment": "Malware payload", "value": "9c410a48ba1f199d0b62a36ff0f7cabccde7ace34abbfa411a93c9f8a0538205e3afe198a49b784a5b4d73bc295707e0", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422428, "uuid": "f586fa8c-ae86-4f64-854c-e2e8fad872d4", "value": "06F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422428, "uuid": "585654a6-e8a5-4aff-9ec5-8fe8d9c1306e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422428, "uuid": "de47b8c3-d923-4b6c-97e0-5b7c3c318e2d", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618422428, "uuid": "175206bf-0664-4375-bcab-2c4443ee6cba", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618422428, "uuid": "07b7fe6c-ad44-49ee-a9c7-320e5f8b258a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422428, "uuid": "8c149a8b-4390-42dd-82d3-b76524e8f132", "value": "67f1b1a0f57b543d90a81478650d3fa1de0557eafc672c0fc38f6068a6e84387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b2c13a-9d74-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618440983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440983, "uuid": "9b936009-9d32-44c1-90bc-dd767db6b9f3", "comment": "Malware payload", "value": "229746defc6bb79eec43b04ef214c5bb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440983, "uuid": "e39b5117-8da6-48ec-93be-b15d5f0f22ea", "comment": "Malware payload", "value": "691e3cd56cc5a348f487c9137edf43b36e086b2db5f1424c0abf2542dcaa9b89", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440983, "uuid": "3bfe9d2e-b0ed-4fc9-9335-e8b8bc4c1632", "comment": "Malware payload", "value": "234ab2f450d00880240d94d1e67398ac0fc81526", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440983, "uuid": "cb834288-3665-4de3-9f38-446318a35782", "comment": "Malware payload", "value": "061f223efbc9890b125dd6a2b66e75f84ee6d11da6ff15ffc3b88d78b05fa94483de1cbe0f0660d6bdc78154903f26ba", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440983, "uuid": "0600d8de-3db4-4cc5-81be-69b92766dd35", "value": "FAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440983, "uuid": "1aa37924-699c-4f98-bfd5-ca34a4655178", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440983, "uuid": "aa47dee4-186f-4519-a2c9-bb33e60298e2", "value": "3072:Ilpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ilo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618440983, "uuid": "22b9cbd8-bf5f-4be5-83b1-31f70e433852", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618440983, "uuid": "c523e684-1616-4196-95d9-836f2370407a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440983, "uuid": "90e1976a-7426-47a0-8319-476c880c4230", "value": "691e3cd56cc5a348f487c9137edf43b36e086b2db5f1424c0abf2542dcaa9b89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65251bf3-9d52-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426277, "uuid": "0ffe1d23-4b45-47e6-b2eb-bb60f98f871e", "comment": "Malware payload", "value": "5242cd1070d66543bf36587283cf9c7f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426277, "uuid": "9a362d4f-c6ed-4fb4-b6c9-a48b613926b4", "comment": "Malware payload", "value": "6af91c4bd3f688ac7c8a64d8ab88978bfa9fd5c22826b1013608f800c612ff41", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426277, "uuid": "143781be-02d2-466e-bbb9-5558914ae670", "comment": "Malware payload", "value": "7a11e9703e1e78f805030bf2cbd578e6a4bf43d4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426277, "uuid": "dd0db29a-30ee-4cca-9f62-169cc50eb09a", "comment": "Malware payload", "value": "1a1c841a76d0fee0662033429ad3bd9c94e03c193ec420ee1bb9af9207d3830f6770f9e83e4c6a12dec3c8784f412b2e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426277, "uuid": "ecf1df01-8f16-4b4e-b356-e61c63bcb212", "value": "65249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426277, "uuid": "79e8653b-2eaf-4516-93c9-61ab6c064895", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426277, "uuid": "3118162d-3137-4e96-b8a4-29637e8cce3b", "value": "3072:Z0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:spepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426277, "uuid": "e5f38817-f7c8-4470-b68b-89e68dc415ca", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426277, "uuid": "b35c50db-0558-4aec-ae56-03ed86ca16d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426277, "uuid": "77ae00bb-6a0d-4d73-86f1-0c3ad48926db", "value": "6af91c4bd3f688ac7c8a64d8ab88978bfa9fd5c22826b1013608f800c612ff41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d0b385-9d71-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439732, "uuid": "5513f26b-144c-4112-b77b-811a1a8821a2", "comment": "Malware payload", "value": "8282250e7b1a75a05587b53ec0ca61e4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439732, "uuid": "e57b098a-6b9f-432d-97ee-529173d60112", "comment": "Malware payload", "value": "6ca0b9160cc01699cb81b46c90894244fdd25adfa85363a84edc4f87b3860918", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439732, "uuid": "f4a304a2-7bdd-4e4d-a607-6ba6bca16779", "comment": "Malware payload", "value": "dd05e367fac75d2cef51a56e29957b8133c5cb99", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439732, "uuid": "95338ab7-565b-4342-953d-f5868b5bb7dd", "comment": "Malware payload", "value": "c925a68058b62b85b9d12299e5c47c3ec15eed8d19c9273484164cba71b9f4a54be55efa4b9183c572d163c459126758", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439732, "uuid": "a6c3d42b-26ff-4b8c-9996-d48b40f33bcf", "value": "E1249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439732, "uuid": "ad7c946a-5daf-452a-98a3-b27d2b27b27a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439732, "uuid": "0f401854-5fed-4189-92a6-31e16138c3ff", "value": "3072:H0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:mpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439732, "uuid": "3793efe9-8964-428b-b086-17ea7707ca79", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439732, "uuid": "459d117a-985b-4b8c-8e8e-b8689e29ab42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439732, "uuid": "36eba148-4b7c-4e1f-b076-c2f942222ad6", "value": "6ca0b9160cc01699cb81b46c90894244fdd25adfa85363a84edc4f87b3860918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558c488b-9d5e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431405, "uuid": "5c527847-f115-45dc-a3ba-2ef716463578", "comment": "Malware payload", "value": "7a4db702283de168caf72e6aff05c173", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431405, "uuid": "1988945b-2e56-4090-8eaf-f343fba2c2c3", "comment": "Malware payload", "value": "6caeb94ad65ac50eced5e0d1636ddf16f5feeaff981747bda14c163602b8a985", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431405, "uuid": "0bb120ab-afb6-4c67-9763-cabd4cd667b4", "comment": "Malware payload", "value": "9e758d89c0cd620c6b95ed600934d136988ef35b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431405, "uuid": "bed4384f-0c00-4deb-ba62-2919cabf0823", "comment": "Malware payload", "value": "ce8d0d122d20756779f0f871032d5b3cb5fb5b9db1cbd7ca40eab5db82b928c3d1c84c92389061c7315e74c6669d14a6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431405, "uuid": "b17a8a3a-92dd-48cc-8772-093f6dfe3270", "value": "03F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431405, "uuid": "5f227f17-c499-4e22-a178-b24164cde760", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431405, "uuid": "c433dd3f-495b-4fbe-beca-f6b21a6bb03f", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431405, "uuid": "74ee0127-e5d9-400b-ba50-6dc275ea5aa7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431405, "uuid": "5d5cdb9f-fd80-48f7-9cb9-b331ba9fb739", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431405, "uuid": "61702a2b-3e90-4bec-8b1f-82f187bbc088", "value": "6caeb94ad65ac50eced5e0d1636ddf16f5feeaff981747bda14c163602b8a985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781b1af9-9cec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618382500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382500, "uuid": "a2c341e6-9f89-4a81-bf01-70134c74c860", "comment": "Malware payload", "value": "b6d292139cbd769bfa7c005cbc3a8202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382500, "uuid": "df84a68f-2110-4d83-878c-b579347e5a92", "comment": "Malware payload", "value": "6e3816fe96ae72f3c7695e1a64225ed36ff8a7e61f0fb192447cb14d5736dcea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382500, "uuid": "b6412fa5-72ea-4e4e-ba8a-1c8ccf619542", "comment": "Malware payload", "value": "f12d48f3aa3a1910795a12fbc57b32d24145af73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382500, "uuid": "7f280015-2b3d-4d69-ac47-470d38f46e80", "comment": "Malware payload", "value": "7a0b6fcea6f4ccf010b570d3c35de54b415420b9627c6e913e017db3e1f0d6e45ab2351729e68f4d9cd6697ab3cd68c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382500, "uuid": "eb9b97d2-b2a1-448a-90b2-abb5439a961e", "value": "C9459FD1F19088DAED6B45F1AD2BA9302497BE9C54A4410C569EBB1B36F3342309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382500, "uuid": "b81293b8-9fcf-46d2-9d64-b16ee199c2ea", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382500, "uuid": "1e52430b-3a0a-423a-989b-ae06e44e57fc", "value": "24576:VJzokgcgPlDlDOkZuFphMbMfZbZ8QCr0Sz:PokgcgZlKkZuFphMoBbZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618382500, "uuid": "2c765c1a-a70c-4cd9-92b3-a01eafdac307", "value": 1192270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618382500, "uuid": "004b4a50-d5fa-40c7-a37a-f2c96138ee5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382500, "uuid": "99754df1-15b5-4559-9491-adf58644c712", "value": "00909000870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8820a4cf-9d4d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424188, "uuid": "172a8203-3adb-4a9a-9605-df732cccbefa", "comment": "Malware payload", "value": "f50ac44ebec46b4b557596a9ea46fdbb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424188, "uuid": "ff308299-5623-4912-8d52-6839fbd73cfa", "comment": "Malware payload", "value": "6e7257ac39cf53e179309da0f257e5dfb4475a16ea2a75f7882539630576aca5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424188, "uuid": "9c96bbe8-876c-4632-9e24-9f41e9cc154d", "comment": "Malware payload", "value": "9a1b786d39b167242ce95ce6b479fbf0ab6e95ed", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424188, "uuid": "8286bdb2-cab1-4691-9bcf-3ff3d369ea19", "comment": "Malware payload", "value": "e0ea2ebe4e11a2e8f493e97664bbcda2fafb5a35e54566d5f5e3570a2c4479d24d7ad814a6c9489f5e49935b2132e50b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424188, "uuid": "73502266-097a-4710-b754-49088dbc70c3", "value": "C9249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424188, "uuid": "9e487878-f08f-47e4-a4c5-1cf369ac98de", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424188, "uuid": "b19d32ef-705f-4001-a727-94b2932e8b55", "value": "3072:J0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:8pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424188, "uuid": "983db9b2-8381-4ba4-ba05-6b05fef1cb8a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424188, "uuid": "81f35195-efff-45b0-9d10-054e918cde10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424188, "uuid": "68422121-1540-4809-804c-85edc80f23f6", "value": "6e7257ac39cf53e179309da0f257e5dfb4475a16ea2a75f7882539630576aca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed84698-9d5f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431742, "uuid": "c3b15b91-9351-475f-9987-7d094ef0feec", "comment": "Malware payload", "value": "5fc65d5f28e1f2521a8ba8938aaa7ec9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431742, "uuid": "3df63766-7865-4176-bad3-ab3b99e630b9", "comment": "Malware payload", "value": "70f6d5c55e53764e33dbb25775a17c9258fe9efd12b481153eb7b1fa3eb59eeb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431742, "uuid": "3449b05f-65ac-430c-bda8-cb3729cd0628", "comment": "Malware payload", "value": "e3b3a8f3ea388d780d6f5c3dffec8e0e4655d3dd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431742, "uuid": "a78e9c9d-e1c9-4547-b555-26fc9319d9f6", "comment": "Malware payload", "value": "67f08369d933bf0771ad23cab697f0f9ff7847b61e14ab45583fea8292ce4e5ce16228b32889a9ec486d54437374c0af", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431742, "uuid": "61a77c15-b807-4a7c-9bdf-cd855a176e34", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431742, "uuid": "d9e84347-ffd3-4360-995f-c38ac658dba0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431742, "uuid": "7261c8db-7e81-4d25-a1a0-2d878fba2563", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431742, "uuid": "a0d5da88-0d7e-4d46-a0db-837eaa3517a0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431742, "uuid": "7b366b13-7926-43b1-acc2-eaf7e8c364a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431742, "uuid": "accc5f7d-07e2-47c2-a4db-cfcdf7487869", "value": "70f6d5c55e53764e33dbb25775a17c9258fe9efd12b481153eb7b1fa3eb59eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b431d6-9d63-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618433735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433735, "uuid": "a40ba92e-f7eb-4861-99f9-09e55ace5dbe", "comment": "Malware payload", "value": "ec840c3ce4ad2518d5e9fd9cfe748009", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433735, "uuid": "ec521370-e411-4f17-8a37-878884b29649", "comment": "Malware payload", "value": "7210777ff8a9f34b40e8e4cd88f210380d8b2253aadfeb5bb55947e28ff19770", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433735, "uuid": "def1a1c9-1a57-4b4c-adb1-aa04729f5163", "comment": "Malware payload", "value": "37ebc66db2a72bba438c08a07958bbda6a62c7b3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433735, "uuid": "4f31de3a-cc3c-4464-9df3-00aadd5d942d", "comment": "Malware payload", "value": "2b0751d9eee5f65fa3bf2014e116cc2bc5fde22fbab35bc5d1fa2f5dee3e773ef980ca32349ce4d03c68a836c0f3c81e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433735, "uuid": "9752a149-8c40-4fe8-a268-c35ad02ef6b5", "value": "6CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433735, "uuid": "d1567dc3-f30f-4723-b81d-8a2e6eabaefe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433735, "uuid": "3e27fb10-d45d-49d6-bec8-af8ab90a4455", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618433735, "uuid": "a33dd466-580f-4736-a36f-1d6b1683cd77", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618433735, "uuid": "24bb215a-3c0a-46b5-b351-2371297943dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433735, "uuid": "758a932f-00a2-484e-96eb-bd565bf4dc26", "value": "7210777ff8a9f34b40e8e4cd88f210380d8b2253aadfeb5bb55947e28ff19770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441ecdb9-9d5a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618429658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429658, "uuid": "f2045cc2-370b-4537-a9cb-a8bb7499f011", "comment": "Malware payload", "value": "d48884efbce2750c4f075f4ffd92464b", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429658, "uuid": "a8e15be1-a5f6-4da8-8b23-d98a0db79ed2", "comment": "Malware payload", "value": "731bff55919a95f462d7a7704100100f123a9016ea77005adb1f6e5908c27472", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429658, "uuid": "62df2b70-2ae5-470f-a128-ee85cd1f8b06", "comment": "Malware payload", "value": "2eb18b652898aacbf88229d67c8dca2d7f596a36", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618429658, "uuid": "a6d37490-3fb6-4d5f-9e85-8145c30c31bf", "comment": "Malware payload", "value": "2e799dad2c51d373702158c2b069b374e1141867a2f9e075355e1607339b0550a4b0af8485bc9b582649bb92e3dca22a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429658, "uuid": "e50e9aae-d2ed-4008-b9df-ee850e69a02b", "value": "93F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429658, "uuid": "0cbf352d-3894-4924-acb1-1144a600a1fc", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429658, "uuid": "22c307c2-ac60-4937-b41c-46cf0f6cb27f", "value": "3072:dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618429658, "uuid": "9b767bb5-d0da-494e-bc52-147581419bf4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618429658, "uuid": "bc8d301e-ff33-483c-afb0-72f269c37f7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618429658, "uuid": "9db24b0a-84d9-4da7-82ed-63335ff5ddba", "value": "731bff55919a95f462d7a7704100100f123a9016ea77005adb1f6e5908c27472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8651dea2-9d56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618428051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428051, "uuid": "b82679f0-8fb0-4dfe-871d-49dc2445d692", "comment": "Malware payload", "value": "611a7dc73d1477da2af28d0fd9649ade", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428051, "uuid": "2e823d93-32bc-4c72-9986-1c21ce319b5f", "comment": "Malware payload", "value": "75832f2f13775f876a643039c6fc5995ce7cd6366109622d9a5e3da1fe660640", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428051, "uuid": "3b2e6e73-61ef-4df4-af88-3ba2662cbc8e", "comment": "Malware payload", "value": "07a3ccc8dfa91b92c3e19507522743424f0be25a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428051, "uuid": "2aa7e4d0-53ba-4eff-87ef-f8757abe4cff", "comment": "Malware payload", "value": "bd69c6b8ffe7cd45c85cb6f7aa747758475fc0ab2a7a8e0f9b8d971d6846345bec2540996b8ad21d670c1c395e329111", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428051, "uuid": "c2d86e37-2e19-41ab-b0f5-8d83a75d4be5", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428051, "uuid": "57cb8288-8980-4d6e-9d43-c4868f2169a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428051, "uuid": "31567c0e-e4cc-4b64-8686-82083908a527", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618428051, "uuid": "58efa01b-eada-4954-85d6-13d3021c2498", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618428051, "uuid": "30bbec79-5095-4963-9a21-e02cb1363aac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428051, "uuid": "d2a0140d-2dfd-43ad-ab88-17ade3a879f3", "value": "75832f2f13775f876a643039c6fc5995ce7cd6366109622d9a5e3da1fe660640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea7ae7b-9d44-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420441, "uuid": "b710369a-ae75-4d61-8d49-36a8f4ce76b4", "comment": "Malware payload", "value": "7a7e442f92fcf552f92384cb2df7320a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420441, "uuid": "6573a4e2-ce5a-4ba7-b267-dc30e656f8bf", "comment": "Malware payload", "value": "75945330bef57508ea32e1c065f1ae08bb3a4db6b52b9e50e1bfea207fa3f7f7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420441, "uuid": "9d48d320-4d35-4980-995c-644258aec7f6", "comment": "Malware payload", "value": "5ebf7567bb9b96ad52c20ce78d543f7d2039f2e3", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420441, "uuid": "568bbee8-53d5-415f-a4ec-c5669bde054c", "comment": "Malware payload", "value": "56ab1eddcbbce6da5167cd33a68fdc0e30de5013bbdff7bd280bfe40963f2a60c9febee7c40458dd39b0f8d64e5c5f6f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420441, "uuid": "de88a81d-973a-411a-9683-a985ea31102c", "value": "2E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420441, "uuid": "803cbd95-cfbb-45ea-9f5d-7b0f2fd1770c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420441, "uuid": "9494f4d6-1ebc-415b-8eae-d7d0aa4ac69d", "value": "3072:D0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ipepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420441, "uuid": "b6d40bcb-d22c-41f0-995a-b1fd967b7999", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420441, "uuid": "8500e9ef-aae8-40a2-b609-7de01582b059", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420441, "uuid": "6cc8aa5e-5a1e-4a3f-885f-2e59107d5699", "value": "75945330bef57508ea32e1c065f1ae08bb3a4db6b52b9e50e1bfea207fa3f7f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087a59b2-9d3f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618417961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417961, "uuid": "8ccc4d76-ef0b-403e-9005-d10e0cb74224", "comment": "Malware payload", "value": "f727ea3432bb9ed6aead13565123a847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417961, "uuid": "ed52cc4d-50c5-4f69-9913-6da122583a0a", "comment": "Malware payload", "value": "759f13f248a3dcf89f4d89afb313919909269eddf7784d79bb7fe166ac3b9c64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417961, "uuid": "5a5e5a63-1186-43c4-80b1-9c70bdcc1576", "comment": "Malware payload", "value": "651cf6c57189c8eacceddf8ec6e79d55c107f88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417961, "uuid": "eba7c095-a6b9-4055-8ef2-f5ac2d1c727a", "comment": "Malware payload", "value": "87b5348148ef2300079642f6be97fc214dabd08fbcf24b2388c545c9fdac25b8575247deedfa389dc8b3b489655486c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417961, "uuid": "05d3e282-3a58-49db-a67a-0e7887d1e09a", "value": "F8F401206A8CFBCAC42E97B5C5A195B51373AB63C359C72FE84C70C859B0781F46939B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417961, "uuid": "691872ef-05e5-49d8-8025-df4e468ede4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417961, "uuid": "426fb0c2-da0a-4982-b4a5-004b6b95cffd", "value": "12288:m2W1I6F+jgRSRxXKgEP7Te7OITZyBYKSXElNKSh90hcwQDlPYiI9pWEE:m2J6F+sEx6gEP7KVEhSUb90hjQpw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618417961, "uuid": "e87fb4d6-cbc3-48a3-bac6-e025099e5136", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618417961, "uuid": "5d798235-124e-43ac-be89-07eb45c642a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417961, "uuid": "50ae5f52-b490-4e82-bbe4-eb45fd7130ea", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0b8e5a-9d69-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618436138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436138, "uuid": "cc3650bc-8ab5-4f4d-b34c-b96e40048e3a", "comment": "Malware payload", "value": "0ee3cd21bda01fc2a75ebfdcac18261c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436138, "uuid": "38f51928-6d02-494b-bc61-a823da156f81", "comment": "Malware payload", "value": "763510c56da31dc8ae3d84f690d2e7a6f7ddf8e847be68cee6adbba04b6fc3d3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436138, "uuid": "ae868a72-b832-46bf-99bf-a18549977a24", "comment": "Malware payload", "value": "7621f035cb6d2d5c73f8b29394af0430707f03c5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436138, "uuid": "328f9d99-b441-49ba-86ea-5f990f8a47e9", "comment": "Malware payload", "value": "1a4ca9ffa23b5988d4507f83b763bbdd9986b60d19e628cfc7b5da6ef03e6a1fecdf020563958f55f1a3ed222d4a9f24", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436138, "uuid": "1bf34baa-ed24-410a-bbe8-c2ea35126e49", "value": "E0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436138, "uuid": "891e18be-826d-4140-ad40-735684795e45", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436138, "uuid": "4acc9847-1e9b-45a3-a7f8-54bbda0e216b", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618436138, "uuid": "0526ff40-c720-4d9f-8047-9419fda767ad", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618436138, "uuid": "f285e935-86d0-42b1-a4ea-e80552a3a2ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436138, "uuid": "1e0a52cc-3758-4f1e-94f0-a1d7c53477c0", "value": "763510c56da31dc8ae3d84f690d2e7a6f7ddf8e847be68cee6adbba04b6fc3d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ff7852-9d39-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618415697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415697, "uuid": "a4ceb5ea-6e71-4098-8c12-80105b19f890", "comment": "Malware payload", "value": "f35cdebf1ff11fedb3b0b813f1cddb63", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415697, "uuid": "86987173-2e1d-49c4-a137-cf7b9a2d9d0e", "comment": "Malware payload", "value": "7858d7ea066716887201cb02dbcd402b4a8c7b07f38783b467574fcad5aec796", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415697, "uuid": "f14bb466-f9ca-4a82-a56a-7196600feb2b", "comment": "Malware payload", "value": "56b864f74d463b08007d677729abe33922ab0d97", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415697, "uuid": "96ca6ce2-5fd4-4064-8e9b-000dfca3eb47", "comment": "Malware payload", "value": "6ee8f6293cc0db1ab8905fa9bca581975da1d542d4b18609942b18c844061797c6891c6bd2d80e88f52d6096c3c97563", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415697, "uuid": "208c964e-7dd9-4356-a86f-17f102e971a4", "value": "D2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415697, "uuid": "d2596453-fcac-44c1-b470-dd0fbac7f9eb", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415697, "uuid": "e56a50a6-77d1-4178-a41f-96d7174fdf21", "value": "3072:4lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:4lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618415697, "uuid": "dd42e8d0-1178-4667-86c3-1b2fdc867165", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618415697, "uuid": "dd431224-2d7f-4bac-89c1-ec65f4af3108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415697, "uuid": "fbf7e3af-9d00-43c4-99ed-38964b29879b", "value": "7858d7ea066716887201cb02dbcd402b4a8c7b07f38783b467574fcad5aec796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad16fef-9d67-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435145, "uuid": "f254a491-b133-40bf-b2c3-620b22331372", "comment": "Malware payload", "value": "da9bd66510a9720e2e61dc9efd15a02c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435145, "uuid": "93893111-9c63-4727-92c2-68448279dad9", "comment": "Malware payload", "value": "78a3d50b09ca8afc2a1450342acfd33d0ea3722d7855a73fa6c36a275910631a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435145, "uuid": "1bc25c81-9051-41c2-b066-6c47db021435", "comment": "Malware payload", "value": "4e4e0f01b7d51980f336071242884b2f01fd29ea", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435145, "uuid": "a4fa701f-b820-48e0-8120-e6ee5ce22ebc", "comment": "Malware payload", "value": "5e1ea45757b825e8535186f8b7d2c0bdc84df33720d62c32c37dd405a7fc60ed8f1ae9c4ea271bb1a75079163c3cfb11", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435145, "uuid": "caa8e7f9-88fe-4b4e-b97c-48df015ea861", "value": "51F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435145, "uuid": "7711e87b-2d94-468e-984d-c129e7498da1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435145, "uuid": "19b31f21-7d2f-468b-9ff4-e2517d12b574", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435145, "uuid": "efd9930c-f6fb-494d-8e81-c72c9e4741ef", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435145, "uuid": "24b4769d-ef0e-44f0-815e-461e512efb6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435145, "uuid": "d20f4882-dfd3-4eaa-b32c-09c45c610479", "value": "78a3d50b09ca8afc2a1450342acfd33d0ea3722d7855a73fa6c36a275910631a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003993df-9d53-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426537, "uuid": "55bc2921-ab50-4a4c-b885-e0d9e87b628c", "comment": "Malware payload", "value": "6567d7e6d411afdac495eda05ab40562", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426537, "uuid": "8e9267a0-05a7-4e7c-9fea-d435fc5b6556", "comment": "Malware payload", "value": "78dd082f4904949808984f20bdc7cdb9e1124edf24db4f11417c87a6b9c2ded5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426537, "uuid": "f839889a-bd3e-41a1-bad1-1c740377a037", "comment": "Malware payload", "value": "82b73077e0d3b418c2b2d501fb7394ec4f4ca8b5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426537, "uuid": "f9202496-b4ac-4cfa-b4b0-78e4653c83f8", "comment": "Malware payload", "value": "7dca4934ac040db53dbd269b5435cc940251b1d27c041d65e6f7254284d7ba54e1df0137215c8a32102d2ff67053d813", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426537, "uuid": "c000e2b3-7555-4c7e-97fc-a1cc87cff003", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426537, "uuid": "0806d5af-72a7-445b-8afa-1f6a9b3d237b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426537, "uuid": "cad1ba35-c07e-46ec-8045-fdf2d2cdff32", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426537, "uuid": "9b072dce-fef7-4a92-bce5-ea23ed597182", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426537, "uuid": "f4b835c9-c9bd-4680-84e5-ee653fdb5432", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426537, "uuid": "e8180393-b3e2-4493-b999-d9e3cfe8951a", "value": "78dd082f4904949808984f20bdc7cdb9e1124edf24db4f11417c87a6b9c2ded5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f939d65-9d73-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618440414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440414, "uuid": "9766bd63-7469-4d9a-9192-62105e4ca4a3", "comment": "Malware payload", "value": "e03bbd5005dfe5fefeb0a56e124f0434", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440414, "uuid": "df506131-fdf2-4e31-8bc0-79b7a2f8caab", "comment": "Malware payload", "value": "796eb2d50ae3903b5f90af39e65e87e5708ed478a689089c1549970aa2cda6b1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440414, "uuid": "8608e345-04c4-49f0-b8f5-412a120c587a", "comment": "Malware payload", "value": "0cbefa39dc275db367d9d5ce688fb24641fb3438", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440414, "uuid": "9fc56a04-4a1f-421e-93a6-23068c783414", "comment": "Malware payload", "value": "85f09fd4fa1dc394ff8540445e7d7ec00878b4d3108a697bdf10310237d6ccaabbda69a4d3abdfaf4c24a7c0b051242a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440414, "uuid": "a7cafd39-f78a-4a5c-a087-c6803d3d9a27", "value": "4BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440414, "uuid": "233c64fc-4d37-4197-b0de-1eeb66c20fe3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440414, "uuid": "aa4b22c8-aec7-4f7a-83a0-cc14c5343305", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618440414, "uuid": "b1ddeec0-e51e-47be-af1f-55fe73c01a23", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618440414, "uuid": "a7c4a8ff-aea1-4ccb-b088-4c61189dd941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440414, "uuid": "594ab9d4-b13c-4cc0-99be-cf811de9f95c", "value": "796eb2d50ae3903b5f90af39e65e87e5708ed478a689089c1549970aa2cda6b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993b9cc9-9d51-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425935, "uuid": "7650e09b-420a-41fd-aa3f-a2b5e452609d", "comment": "Malware payload", "value": "81aa5f8a55f49317f8a5204c6717d354", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425935, "uuid": "b1121823-ff54-4eae-bab6-a60ec038cac2", "comment": "Malware payload", "value": "7a0e498d5275096fc1bd2aee17ad2f9a72db3c9a2f674b2124c2d930fea003b7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425935, "uuid": "41727aa9-d74f-4fff-854b-92ec6cc8fb23", "comment": "Malware payload", "value": "9ff8dc48a5ac0d1ed41f70704df054e51a357dfb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425935, "uuid": "ed3da741-4285-486d-99c5-e40248ae3bee", "comment": "Malware payload", "value": "84b5133eaf5869c8f1999ffd1fcab29e512852746eca087984444fd6bc7c694cd5a170776098e69f4ed13a5b6c84e391", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425935, "uuid": "e768baf6-798b-4bce-a877-b8f2db9d1f44", "value": "D9F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425935, "uuid": "c7b30ef5-4983-4c04-91f0-aca0fb144fad", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425935, "uuid": "dc934e03-627c-43c7-849e-d970cac64391", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425935, "uuid": "ee23acde-a1aa-44eb-b958-6b41557561ab", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425935, "uuid": "61296eb2-2119-406a-aed9-ab77f507ae77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425935, "uuid": "7c725f58-24b7-48cc-8076-6b3190e6335f", "value": "7a0e498d5275096fc1bd2aee17ad2f9a72db3c9a2f674b2124c2d930fea003b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8491715-9d5d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431195, "uuid": "26ed0870-6794-4a9d-83ab-3852eb3edf42", "comment": "Malware payload", "value": "fd0f7060e3fbfa9e7658e8e9919d313d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431195, "uuid": "0d5d3009-b330-465b-b48c-ddfa403fc40d", "comment": "Malware payload", "value": "7a52fffd8e45d25e081b137a4c4dc9299e7b2f2daa7dcce0665adf9fae32a566", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431195, "uuid": "82283a12-1df1-4a78-b99c-85d2f980ddc6", "comment": "Malware payload", "value": "b89ad5dd9384e585d3a845eaf6ba1d9473c85164", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431195, "uuid": "df86d073-a136-4638-bdfc-e8c1ad08de06", "comment": "Malware payload", "value": "ba35917b4c78d07446d8c7addbf01538e5bc9d10ecdd5d4373f17cec5f2cde856fa378d70a44e7e6f56b28665529f592", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431195, "uuid": "0591d338-d338-4d3b-9bab-75d446d92f1e", "value": "D2249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431195, "uuid": "01e85a7c-7b30-4ff3-87fc-ffeb9b8a24a1", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431195, "uuid": "af798d2e-72ce-4c66-83e7-e733c55a183d", "value": "3072:e0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:9pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431195, "uuid": "6c7df87c-8a7d-4720-ba69-b4d35d511026", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431195, "uuid": "56aaf1dd-e959-45ee-8559-f315318011b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431195, "uuid": "9dec5894-a4c3-4eb2-85b8-21c515d0016c", "value": "7a52fffd8e45d25e081b137a4c4dc9299e7b2f2daa7dcce0665adf9fae32a566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3082f48-9d3d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618417361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417361, "uuid": "052b98a8-2d82-42e5-9248-a16d0b01d553", "comment": "Malware payload", "value": "5ff7f7430a55373351ffd209ab66ed79", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417361, "uuid": "ccf05da7-a06e-4272-96d7-353122725a1d", "comment": "Malware payload", "value": "7b9dbef22b8973d1e7e2abf0afe51caa78ef3f637e68733da531162ef980aba1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417361, "uuid": "9b243594-3cd2-49ad-ad86-5783d24c4508", "comment": "Malware payload", "value": "f8c5906d15d4f4942ab8670f29f64398d75cf646", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417361, "uuid": "453f3f3f-f3e1-4295-aa79-40a1e2e73cdc", "comment": "Malware payload", "value": "6100cbf799008d82d8d5d5505c0eb796793a8bd3d127c0cbb01b787b2a695772cde3c83e0fe53cb6eee71a48e3472fd5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417361, "uuid": "52b42ee2-ecda-4bb2-9baf-dac173087899", "value": "71249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417361, "uuid": "461fe814-9f16-4c9d-9b6a-094e75dc8837", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417361, "uuid": "c08c1ebd-1c24-436c-ae31-17ee59aa9caa", "value": "3072:s0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:XpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618417361, "uuid": "b433fd2f-e23c-4ff8-b620-00edbb6ebb78", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618417361, "uuid": "d43db297-363f-4a3f-be99-d10ffc8b69f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417361, "uuid": "7875fa18-922a-4ac3-a557-2ff9d71f6fb6", "value": "7b9dbef22b8973d1e7e2abf0afe51caa78ef3f637e68733da531162ef980aba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c877eb6-9d5f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431712, "uuid": "9512b753-82d2-46c4-a01c-4f9fac9fc8d9", "comment": "Malware payload", "value": "b33205b67c05a857aa3a8e3b29cd180b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431712, "uuid": "4c7474fd-9e81-4391-b5e5-7aab979d1241", "comment": "Malware payload", "value": "7ba7221a7c6480d3e18b73ee065eea06686f181058d73744a7964618f214111b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431712, "uuid": "2655bd1f-fa6f-41ab-840c-0aaae956e580", "comment": "Malware payload", "value": "4db4fd6061f8642e0eba997a2f4ea51d7d4cb709", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431712, "uuid": "162f866f-f81c-4981-83c0-61c4ad6dd6bc", "comment": "Malware payload", "value": "a018a75294d0c3168218f8d5229e56895df38688db22677bcc73d49b82a4a0c4c253f1f40c04a016324026c0dcd4f20b", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431712, "uuid": "5abc0d8f-c60c-4833-aa5d-be84e365cc1f", "value": "07249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431712, "uuid": "6aa6a8bf-5f86-4e8c-be0b-b8136a0586b2", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431712, "uuid": "bca76481-906a-4180-844c-78bc25a14451", "value": "3072:90DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:gpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431712, "uuid": "77f1e4f8-906e-41d2-abf7-10c732976b4c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431712, "uuid": "dcf0e02f-d415-42d9-a649-db56616829b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431712, "uuid": "fa523e4c-8b08-4f87-8842-559d79efb0ba", "value": "7ba7221a7c6480d3e18b73ee065eea06686f181058d73744a7964618f214111b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800f5850-9d5c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430617, "uuid": "8d47e157-e176-4619-a9e5-62563890c133", "comment": "Malware payload", "value": "d60e5249132a7ac6782a752ef6dd2003", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430617, "uuid": "758c5e4e-4207-4d7c-ab18-cc79a42c5310", "comment": "Malware payload", "value": "7ceaf34c276168221e8b532f83d357c166bd71d09cbf796901ea40892b8b73be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430617, "uuid": "76b89564-d40b-4015-b1f3-dc87719871e4", "comment": "Malware payload", "value": "df36cba07bebd74eb45e2599a82cd27f5538dda6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430617, "uuid": "261790a4-3c57-43cb-9aba-02360694e688", "comment": "Malware payload", "value": "448f0b331ffd21d1219151d32ebf7663613a280ede771e141c14a2e4abee7421feea64e933912becadc82a12cf223370", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430617, "uuid": "9096f3e4-e59a-4edc-bed9-7f04eacf120e", "value": "A2741236ED739007FCA545F4FE0725746FB9E09BB8905766E64CD03EA4203F2C14A62A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430617, "uuid": "053e167d-912d-45ab-8244-bc53daad8e88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430617, "uuid": "5f32da62-4e30-4f80-8dc8-6ac42ab16414", "value": "6144:vobswX1gpWQPU9vOm0iqrnkhiU+0ynGr4sX79cKXs1qs5I6IRufWjsMnMCBLElc:+soG0QP4knZvnWT79J8VrfuMCBwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430617, "uuid": "2d1aacdd-c6ca-458c-b79f-ae0602ef6839", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430617, "uuid": "6e6caec8-9e02-4f78-b624-8d3e948a4d4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430617, "uuid": "0538c838-a01a-473e-83b7-8c188fc8113f", "value": "SecuriteInfo.com.Trojan.Packed2.41837.3099.28249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3dd3f9-9d5c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430825, "uuid": "6d35eae0-9e62-4953-a858-80431d78e731", "comment": "Malware payload", "value": "bd4a02f369320a673513a87a7c6579e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430825, "uuid": "5e352374-305b-4b8b-8e39-d9aae1c469c8", "comment": "Malware payload", "value": "7d7f96e0457782071877a8cc7dd38f07b93a1cf34f3ce594cb914f64c7ec195b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430825, "uuid": "c5762f07-a03c-44c6-8731-209d6dd9f4b8", "comment": "Malware payload", "value": "ff5a2222b6172de22fab85bdc6431bca8e2045d4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430825, "uuid": "729d7788-6fef-475b-8f7c-2bd0c0c459db", "comment": "Malware payload", "value": "3b46d7f2c0fced23e1b8c6e4d07c7738c9e6b8887fa3c57b306d6bb2e863be1aa83d4715d00ebb98a0d51b566b84b118", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430825, "uuid": "f0ce28ec-ec2b-43f3-9286-ba71e7d57844", "value": "D834264AB582CC2FCB9801794DEACFF9A792AC45DD48A1873104FB2E38FE554D7A6341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430825, "uuid": "754f0dd6-33ae-48f9-80fb-175ed293b0c4", "value": "3072:+TEuS2g5f1SWlj2cCVwLbHYgyCgGo5Kxs8uCxzHL8sLNcPcUTVuMk:MA2gF8Wlj5CVwLbTf67Cz+UU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430825, "uuid": "814d73fb-b66c-406e-a3ed-72ca46d4f2c6", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430825, "uuid": "9fdee11f-8e33-4aac-9ad2-ba68bee44df1", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430825, "uuid": "3d0e5f43-cdf1-4244-b1ab-fa39a098d06a", "value": "SecuriteInfo.com.VBA.Amphitryon.183.18150.24322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74badb90-9d65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618434464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434464, "uuid": "caac4cc8-1687-48f4-b1af-4a7eb27f0b2e", "comment": "Malware payload", "value": "4d4cce24057743bf870355c565cdb3bc", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434464, "uuid": "be37cac5-07dd-47bf-9889-c424b6031614", "comment": "Malware payload", "value": "7e1fcdf8f699419c676294f5a5d32bad33387953033f5c190c35ae591a1ab880", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434464, "uuid": "bd0091d5-fb58-4326-9b2e-363f58fafa69", "comment": "Malware payload", "value": "10521629c069defe9748e4bfa7202104c221e5f1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434464, "uuid": "c2c4362d-23e7-4ac7-9afa-af1ae507161b", "comment": "Malware payload", "value": "ec74888e4ef19819a4ee15ad9ca43a61faeaa924a1f68f20451c6c333f85ce02db2f5e347e56b4ed94831c1f4126040a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434464, "uuid": "1877543a-1835-4861-acc8-9b604a0fa353", "value": "B5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434464, "uuid": "f54624df-fe32-4af7-b9d9-e7fcdc6ad49c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434464, "uuid": "443a89d2-2583-4557-9363-324181f7edbe", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618434464, "uuid": "3f8c78c4-2160-4234-b2b7-72e0bd8da2a0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618434464, "uuid": "99ea6657-d31e-4201-ae23-0a753c483363", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434464, "uuid": "0117fb43-d2d7-41dd-9d46-16b753817997", "value": "7e1fcdf8f699419c676294f5a5d32bad33387953033f5c190c35ae591a1ab880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64963c9f-9d3b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618416398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416398, "uuid": "edeec219-e1cb-4809-b167-b82339f0fb42", "comment": "Malware payload", "value": "dceee0a34bd5813d5fba51a24085ce5e", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416398, "uuid": "cc1dc98d-5098-4d7d-a586-6ececfa0e376", "comment": "Malware payload", "value": "7e46ad9430fcb602f84dad4133d97403997384688d57c3dc39b9090e7711b189", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416398, "uuid": "5315a885-fcd1-4e80-8f72-df08aad5008c", "comment": "Malware payload", "value": "b314b09e8a99ee2d5abd1ffb951e65be8cb9d5a1", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416398, "uuid": "f57b7c5b-c35b-41bc-9d18-8893228e5981", "comment": "Malware payload", "value": "0af41b966e32eff236cd7690cd01738d17458d8beae8d654e81f26a3269ec22c9875e463489b5404889d31070c22ede7", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416398, "uuid": "e9e3d776-69ed-4d8a-ad67-b40b326ad8e5", "value": "76F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416398, "uuid": "4bf12f9f-6f7e-41fb-bc53-5f395c3e4020", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416398, "uuid": "b5d1ba67-8c46-41e8-a12c-cd4a7e6e08f6", "value": "3072:Olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618416398, "uuid": "0e9795b5-1f23-4a96-ac70-fe19be18fb10", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618416398, "uuid": "c8fbe6dd-f8b8-45f0-9587-c2bdaf55fc48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416398, "uuid": "dfadfbc6-c9de-43a5-a9e5-36ae68ea7052", "value": "7e46ad9430fcb602f84dad4133d97403997384688d57c3dc39b9090e7711b189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e39cdb1-9d7d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618444707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444707, "uuid": "525ba113-04d5-4830-9a51-55ed82dfcd5b", "comment": "Malware payload", "value": "28fdf69f4c9d485b73a64418cb3ee981", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444707, "uuid": "2c361f3e-61c7-4da7-9f37-8af3dfd4ca05", "comment": "Malware payload", "value": "7f23a90488255c8922e832ac4aeacbea2dc42444d61d3f18b30901936977381e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444707, "uuid": "b6b899e6-4e2e-446e-915f-4f49082a7df0", "comment": "Malware payload", "value": "558c9b3b104e8d4128139630c4a5d64a05b10387", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444707, "uuid": "786dc888-3189-41c3-81ec-f22184b04e5c", "comment": "Malware payload", "value": "b9520d891749a10bc05db7cfcb11f226a8a4fafc2f63ebd5578ae2dd6389805a583df39e12eef81146c4386c6bfd2c6f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444707, "uuid": "85888bb2-ec8c-4736-8945-d1d475b92aef", "value": "75249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444707, "uuid": "941a49b5-56b5-4d81-96ab-07b8362aede4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444707, "uuid": "c65f874e-15f7-4780-b599-5e5f66655ec5", "value": "3072:v0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:upepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618444707, "uuid": "a2f5cb76-9b0a-45f8-ac3f-7d3550587a2c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618444707, "uuid": "791e57a0-35d0-4407-a5d2-df472ee14dc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444707, "uuid": "049e64bb-83e9-4ce0-a08d-b7bab4826db6", "value": "7f23a90488255c8922e832ac4aeacbea2dc42444d61d3f18b30901936977381e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f206b8-9d40-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418566, "uuid": "363c27db-0a28-426f-a4e0-1c8a21da9a2e", "comment": "Malware payload", "value": "f88d9ad50c199194d10f43e3c05b1cd5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418566, "uuid": "d4520042-c590-44c3-a8f8-72e26de4335f", "comment": "Malware payload", "value": "7f52fab3fdde05dcc5459c2053b4d1b7acff6c8b8a70eb8394e8be37d253af7b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418566, "uuid": "88b95374-5fa9-4e32-abad-3f16bea597b7", "comment": "Malware payload", "value": "40ab7cbe299b5f97289c88d6c438359b8e9bcf1b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418566, "uuid": "959e3888-73e6-4b91-bf82-7651dcd8757a", "comment": "Malware payload", "value": "8d33c677342427963eedfe6988f65fc43c8bc69257b9bfcf37c99a9b74952aaf763b3593becbd3bbb20f855a6302289d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418566, "uuid": "b54b0285-2a97-4ba4-b3c8-e1fbe76e7b12", "value": "22F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418566, "uuid": "3f987a60-45c2-4626-b416-255b3e99ed53", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418566, "uuid": "ce89fb14-0d3f-4927-920b-4c75355bcb17", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418566, "uuid": "2000ebdc-4a0f-4012-b8bf-f91de757145b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418566, "uuid": "f893193e-9805-4b44-b50f-238e95fd327b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418566, "uuid": "c4d4dd89-ee4b-4b7a-ac52-048a85c5698a", "value": "7f52fab3fdde05dcc5459c2053b4d1b7acff6c8b8a70eb8394e8be37d253af7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b36b70-9d38-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618415049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415049, "uuid": "3916d9b9-baa4-482c-bb9e-33e138548838", "comment": "Malware payload", "value": "2acbf70da734133dff14242318904101", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415049, "uuid": "2b1c371f-6b53-4bab-a2d6-5d9a3e171cf9", "comment": "Malware payload", "value": "80361076fa0c68925d2aea055c3e83392898863c10447e19bae8a4cff0ada21e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415049, "uuid": "8d2c110c-6d1f-4b3f-829d-64f941eec912", "comment": "Malware payload", "value": "71e061e46a920c767601fa4560a507611744fbad", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415049, "uuid": "6f2db75d-6d3c-4ae1-9f44-a030a59466e1", "comment": "Malware payload", "value": "37097bba42c32bcab98d74711a0fe16b26600b34a2fa4112360ee1eae4d5a8d57f478b7fceae0adfbf31173d6ce37f67", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415049, "uuid": "d80b79d6-cd76-47ab-b183-6c064fdc9db0", "value": "8F249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415049, "uuid": "2ea0fce0-7e8c-46a5-b625-d81107d3ef4a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415049, "uuid": "bdf767bf-c774-4fa1-a773-6637a5adf52c", "value": "3072:S0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:RpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618415049, "uuid": "f20b8d3c-36d8-492b-8e9f-660189c9360e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618415049, "uuid": "89e6a595-1434-4fab-b7a7-62a155abde5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415049, "uuid": "4eb8e150-ad54-47b7-9384-931e235a0529", "value": "80361076fa0c68925d2aea055c3e83392898863c10447e19bae8a4cff0ada21e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd76786d-9d50-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425593, "uuid": "58d0a92e-cfec-4bee-b79a-b63a5715f144", "comment": "Malware payload", "value": "0d5427fc566e5d7b30f27199708f1890", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425593, "uuid": "725a6794-4c03-4d20-b9cb-eb456165d8b4", "comment": "Malware payload", "value": "8241b38e9599b9fc6a4c14328f74484b5095d39645cc804b8385d404fb0b4689", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425593, "uuid": "f63117eb-862d-4ed6-a6fd-5b81bacc8f7c", "comment": "Malware payload", "value": "d1d35ddbc9b542fc44725b5789c4de3342c91800", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425593, "uuid": "76489585-9e69-4d8a-8cce-23eccc99f6b2", "comment": "Malware payload", "value": "3772c61a21f17f75933e73c0ce31532b61b43950a3dcaa165d1278719476c1e0637b03f5e4f5456bac9bc2604484bc6c", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425593, "uuid": "5945b75a-e903-44c3-8069-e82af855f100", "value": "AEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425593, "uuid": "84f96fa1-a81e-4c87-816b-e05d4572430b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425593, "uuid": "c287a165-3e1b-4185-afa2-317af7cd405b", "value": "3072:dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425593, "uuid": "49be184d-6160-4550-ba35-682a0253e0ce", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425593, "uuid": "98b196a7-6424-4bf0-b4a3-c54d02c672f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425593, "uuid": "acc7e198-c780-402e-b3d9-96fac29bf95a", "value": "8241b38e9599b9fc6a4c14328f74484b5095d39645cc804b8385d404fb0b4689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0179d3-9d70-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439091, "uuid": "b968dd10-ee13-4a8b-9662-d7548ed3a243", "comment": "Malware payload", "value": "ffc6611ab7cbab82a3fd736a531d956d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439091, "uuid": "d29f869b-3c5b-4a99-a94c-f32caf27613e", "comment": "Malware payload", "value": "8242c20d6b45e7a9a5bfdef5bfddf9cc37b28eff8ef8126ee6310883e401280f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439091, "uuid": "689124f4-2d3a-4b19-a7d5-aed92017eac0", "comment": "Malware payload", "value": "3cfa9430799083d3fa3ff37f8cca8571226213bd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439091, "uuid": "c6ef0d2d-e1d0-4e30-bc65-8b45868f551b", "comment": "Malware payload", "value": "2900f13aeafd663eb4eb9e06443f8718b4ef144dcdbe360542614f333955f29d46db13eda891ba9ce9c3670085229f3a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439091, "uuid": "40f5baa4-aad8-4ef9-aeb2-990b4d10dd3a", "value": "FFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439091, "uuid": "df5739a2-7f3f-4710-88a9-c0b82547a91b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439091, "uuid": "2a6c4d88-6cf1-4b5c-9e05-26fce1105715", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439091, "uuid": "9e282a57-d6ca-4e52-8152-f658270a8b96", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439091, "uuid": "e64b508d-7b4b-4ce3-b2ec-2f5b8e8671b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439091, "uuid": "cee342be-cdf2-4626-8772-30810f6dfcec", "value": "8242c20d6b45e7a9a5bfdef5bfddf9cc37b28eff8ef8126ee6310883e401280f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c3302b-9d50-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425437, "uuid": "35650fdd-725d-4129-84f9-7ff964f87cbc", "comment": "Malware payload", "value": "d83622137251e17001365ed4e1f8231a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425437, "uuid": "c62d9b07-670e-42cb-aa97-d665991efb97", "comment": "Malware payload", "value": "829f2370ffa35e1bae9509683c34dadedfe17a6e4e358a994c1f19befde0cc80", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425437, "uuid": "9b126049-bff4-46b4-a853-5b91a4fcb00c", "comment": "Malware payload", "value": "7b57b5203df94f0c110a87ae7cd40641757d56e2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425437, "uuid": "ad57c376-d677-4ef9-bd3b-8a7a5ed84bdc", "comment": "Malware payload", "value": "a506aecb7d440ab4b909b4dcc01865d38e1c5b86479d6f15b10d6d78751679f6b5707154687eff11cfffc07036ca27f6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425437, "uuid": "091d3784-bfce-4f2f-8ad6-dd35348478ac", "value": "64249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425437, "uuid": "d37c6624-748c-4496-b949-c0d6e32457ca", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425437, "uuid": "bb190884-35d7-4eb0-8a19-c9cf57106fdf", "value": "3072:g0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:bpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425437, "uuid": "df60fabf-cea2-424b-a79a-41ef844ed92f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425437, "uuid": "b0a98e19-d7c6-4133-a866-91a3565cb29a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425437, "uuid": "b46ff49c-c127-41df-bb0f-a1291c9e312d", "value": "829f2370ffa35e1bae9509683c34dadedfe17a6e4e358a994c1f19befde0cc80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2e09e4-9d28-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618408356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618408356, "uuid": "a5504fd4-c8d1-4c2f-8e9c-5dd6c5e958ae", "comment": "Malware payload", "value": "9ec6926752901fced1cea2e7a83fe547", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618408356, "uuid": "b11e9e17-3631-4d3a-90df-71187c50d338", "comment": "Malware payload", "value": "82e9ec639d90dfa7f8c036c500c91e6f07a4a4a26ec6c9131346b11bf0bdda64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618408356, "uuid": "d5d50e8b-f56d-4d10-b4a4-3d1658b531a5", "comment": "Malware payload", "value": "de3be51645bf0ac4950f573c72fa8f49d072b989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618408356, "uuid": "71434da8-7222-4942-b21f-a63525717d36", "comment": "Malware payload", "value": "f35e589518503b04c21f0d43d8c8344ce632e3f5c892097d736861455c1905ff1555196b2ce3e8b7873e2235484b61fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618408356, "uuid": "319ec1ef-3b93-4ebc-bbf3-a6530e194de2", "value": "DA84BF64AF931F5BC6DCC2FD50C2D159C9A9FC5DC2B1291A33B2CA9AFE00544ED2C686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618408356, "uuid": "79829c80-5553-4b38-9c01-4a1ba21380f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618408356, "uuid": "6e73dffa-6ee0-4c7d-94ed-a0ed1b50b1cf", "value": "6144:L+xozdBA3ikQjRnQDetQwBnP9i8fvvuFp:L+NG88fvvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618408356, "uuid": "53903d1a-fa97-4a49-8206-4aaf8030d3c7", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618408356, "uuid": "1ef64aa2-307c-4c55-b792-3642d11314fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618408356, "uuid": "ee8598dc-4096-45de-882e-5344466a428e", "value": "4W6Z5XTA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a42d349-9d48-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618421964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421964, "uuid": "8b34f85d-35e1-4425-8c29-361354dbd592", "comment": "Malware payload", "value": "91cb84dbd7c6c33ee9b0814236ac4622", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421964, "uuid": "9f171abc-09f3-46aa-9f33-c3d8749e09a4", "comment": "Malware payload", "value": "83ee511a675d6cdcfdc112cd3db14a0df764434c3ee5c1b86f7e7d17ed875431", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421964, "uuid": "681c29f5-179e-47d7-bcc5-853c36840549", "comment": "Malware payload", "value": "94f99ebc86d5b9acdd6a24be865ca52f60e04372", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421964, "uuid": "dab73e98-b1a5-48d8-8eb4-881515207e34", "comment": "Malware payload", "value": "4296eb35db56086d536c2653ef2a064aebbc5e47054a6824b344595196cf3b98983b670770be5a103b48816b9d0e0207", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421964, "uuid": "6c96e82c-c5e9-4557-851c-1ab537013422", "value": "C5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421964, "uuid": "83cfb1d2-94d0-45d4-8af8-a982413894ca", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421964, "uuid": "08f2e41e-3377-4ff5-b53b-80c3bd1e7890", "value": "3072:plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421964, "uuid": "b5938b2f-768a-4d12-88f7-52c457a5558d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421964, "uuid": "a05137c5-18e9-46d1-91ac-0f5aeb173355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421964, "uuid": "c4581eb2-f036-485a-8592-2a20c8a9ff84", "value": "83ee511a675d6cdcfdc112cd3db14a0df764434c3ee5c1b86f7e7d17ed875431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2c8cff-9d41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418937, "uuid": "51a22948-4ea5-4401-93bf-34877e90e315", "comment": "Malware payload", "value": "d3e5f8551901bb3fe5442205295629c4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418937, "uuid": "108afa6b-c269-418d-b2fc-db099ec7edc1", "comment": "Malware payload", "value": "846b84e2bbccf15029d6740dc0c0a78a8ed0144631524105b1f302f46baa132e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418937, "uuid": "3e446537-580b-4a99-83ae-50052a3d3460", "comment": "Malware payload", "value": "c4954f0ed0fca0950d600d70d615ea331eb4723e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418937, "uuid": "b5600265-fe0c-47ea-a7c1-0c1430f22c92", "comment": "Malware payload", "value": "89e3b625f51489400706a7878920f5496edcd42e0e49a4ba7f9806d5fdba0cc09f03fd53ebaa9e39d34608d02377b082", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418937, "uuid": "2e4f826a-d681-4613-b4d4-00c692bbac2e", "value": "03F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418937, "uuid": "dac2ef2e-f789-421c-8291-e394a634db65", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418937, "uuid": "9cf4ab51-b101-4b4c-aa91-0593ecc83ec5", "value": "3072:4lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:4lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418937, "uuid": "6a92288a-02cf-46d8-992c-660b2261bc37", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418937, "uuid": "6477f06b-6364-4ae0-9e48-612dac10e351", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418937, "uuid": "64c4fea7-f8a4-4aa6-b78b-0b388c06c767", "value": "846b84e2bbccf15029d6740dc0c0a78a8ed0144631524105b1f302f46baa132e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e4d9b8-9d60-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432365, "uuid": "f8eb8912-4614-4f3d-9c99-e918d11ede96", "comment": "Malware payload", "value": "8e45a9c727efcb39d5d1991d0ea8ba31", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432365, "uuid": "d52843e0-47e9-4a82-b60d-9cd3448f33f3", "comment": "Malware payload", "value": "846f57c1f6da3872e62455df8fd36c48e172a3dd2ea7aa3cd8dc3141d35abde8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432365, "uuid": "df1b4c51-997c-40a0-b455-1dc6017faadf", "comment": "Malware payload", "value": "1789b886c1b5be07c5632d395eca17847a1e4f2d", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432365, "uuid": "2c72238c-54f5-401f-8573-ebcbf6241764", "comment": "Malware payload", "value": "bf7c907f919090220e90fd18892cac0fdba6e540fdfb40d173da350f35ee97d0a08852f4124f5fb896f794aab240a1f6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432365, "uuid": "e88a8389-0088-4fef-ab55-8f641c592171", "value": "0BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432365, "uuid": "f67fee26-e501-4d42-8097-74a437fb14a4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432365, "uuid": "0780d99f-088f-4de8-9d66-b5a07f96eef8", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432365, "uuid": "7fb89ae0-ee9e-46bc-8cb0-118fdd7e42b5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432365, "uuid": "c513a936-12d2-4430-b305-bf2104870697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432365, "uuid": "96f1bda0-0bc1-468d-a1a9-c73d6c31c800", "value": "846f57c1f6da3872e62455df8fd36c48e172a3dd2ea7aa3cd8dc3141d35abde8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fec138f-9d58-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618428926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428926, "uuid": "95bb949b-8f9b-40c4-b0a3-1bb3d8b561e1", "comment": "Malware payload", "value": "ce5e78dc5ebc3525c26e9dc69ffa3d83", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428926, "uuid": "d72c4720-652f-46b6-949d-8a6c026e059a", "comment": "Malware payload", "value": "8472a726712c4fe0e355dc4d814d6ae3ea59b6d70abac48758eec78b421d5ef7", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428926, "uuid": "dd3d8fe8-6032-47c4-b18e-6911cfd4253e", "comment": "Malware payload", "value": "d8daddc0d7ca2e47aa3a2e78d14e0d54a7b8a5e5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428926, "uuid": "8bd4d063-2fac-4596-8fd8-895b7e9a53a6", "comment": "Malware payload", "value": "4a4d2cd768bd25516e67f633e4e5e99917c9b39a566453395e5f637eab3dd5621958356b377b5a41ed92a6e7ec4d2634", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428926, "uuid": "2a454945-caf0-4b72-9b59-0df392eb39b7", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428926, "uuid": "48aeabaf-5509-4829-bb1f-c5b19f4f3225", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428926, "uuid": "8a1b2a46-1aa3-46d8-9136-589e06fb8bcf", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618428926, "uuid": "a8558c46-be55-4ea7-92ef-2458ef29f8dc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618428926, "uuid": "495c91eb-0bc5-4feb-82b2-f7459b0043b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428926, "uuid": "ae78c205-d999-409e-b682-4a6a41c97493", "value": "8472a726712c4fe0e355dc4d814d6ae3ea59b6d70abac48758eec78b421d5ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c78ae22-9d70-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439067, "uuid": "35d7cd95-2720-4b12-ad96-7cbd703ee4bc", "comment": "Malware payload", "value": "a78cc72fcad46cff6d75a00ed6ff854f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439067, "uuid": "27c3acf5-499e-4c69-8b16-97b4ace84d26", "comment": "Malware payload", "value": "8498f5b20481d285320787a8cf95fde6b07c8b7f1c51461de8a6354d57878854", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439067, "uuid": "0d373c7d-0df3-490e-85d9-d114b3ba5084", "comment": "Malware payload", "value": "18373fa232e3ba0691a53d982188cbdb35f32035", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439067, "uuid": "00c4350a-6cde-4344-807e-13a842e54f69", "comment": "Malware payload", "value": "7b10e0729272e31c5562cb6b520138ed875147278281f6a032ddbf2c9e09e7e85283aff58ac0a2bdde77a4a5971eeac6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439067, "uuid": "00456ef6-44f6-4158-9bef-764913b57a18", "value": "3EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439067, "uuid": "f0c6c30a-5c81-4a96-923c-4c23dc2f80b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439067, "uuid": "8a0bae17-59b2-485f-af95-64a52df2c6f0", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439067, "uuid": "a304a550-67f6-44b3-916a-858a9670282a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439067, "uuid": "e27521e8-5899-4e15-9dfd-29cf6bf52372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439067, "uuid": "44628461-bd29-484b-abbc-39ce23953cb2", "value": "8498f5b20481d285320787a8cf95fde6b07c8b7f1c51461de8a6354d57878854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb43772-9cee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618383392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383392, "uuid": "ef250b6c-136c-4323-bb66-b8b21e0d67c4", "comment": "Malware payload (Formbook)", "value": "76538dfefe8f5c5c19a57a6578ca7709", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383392, "uuid": "25da54de-1b08-495d-8e7c-e83c4e037839", "comment": "Malware payload (Formbook)", "value": "84f29ec5ccf489e870cba5f54cc405e9456afb53b3265bd55c0c2643317f53ec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383392, "uuid": "810d94e0-6a54-429e-8665-15977bb1dfb0", "comment": "Malware payload (Formbook)", "value": "50dc6cb6c6a2ef419ccb17c7d7095bd6576fc128", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383392, "uuid": "b97bf6f8-cdbd-4509-8549-e9867368a337", "comment": "Malware payload (Formbook)", "value": "40926ca293492a797ebef9d7fe2ade10e49d6e8fbad38db7d3c42d1042f5c7f5d19a08bb0a6fd7d99221e16222148cab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383392, "uuid": "4f07904e-1402-47e7-af52-91d2255f3ee8", "value": "2915F1323BA86757E57E133884B1419502F1FC1072B7DA1E3CE4758D6AB2B528762B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383392, "uuid": "fed40615-34d0-4699-95e1-eca80e695af8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383392, "uuid": "ed766557-0711-418e-b50b-57de0256b129", "value": "12288:tKto518atg6+cnrdx17j9qXNWI+LW042zofVfebap0VInoQJ8Mbxo518atkKkR5B:4to5hg6lx17zIgc9wkRbxo5hrkR57t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618383392, "uuid": "1f266266-ebf0-495e-bcfa-cbb270a7f415", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618383392, "uuid": "6139adb9-12c5-40f3-87dd-3b0533ecbae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383392, "uuid": "add94d06-36df-4852-af75-ac90dce36256", "value": "QUA-2021-A0010-B-01-2021-04-09-14-13-51-548 FT Quarto-doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4251cd58-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424930, "uuid": "71e852bb-5bbb-43d1-a1d7-06807b572e6e", "comment": "Malware payload", "value": "bada1353fcb262d96362d67c2e7c3bb3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424930, "uuid": "2093bf66-0e50-400f-88fa-e5215a5c536d", "comment": "Malware payload", "value": "85611eb1feb06c4a98b507edb87a77483080beb6c64b674c6414e036afd44904", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424930, "uuid": "2b68bd21-d739-42ea-8b72-920fc74887de", "comment": "Malware payload", "value": "a7022cab993329b9f5265633ada9ad1336837da8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424930, "uuid": "fca02389-c4a6-4954-b5b0-d8e8e95bc333", "comment": "Malware payload", "value": "7ee36894c91671828e7fb473f6e22dbcf6cf31e9a97d7ed666296b02bc84f78ba03cc6cbe95195d0ec0c5592a0992b8d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424930, "uuid": "90d20707-1bc4-4a1e-a60d-c760e4b5129b", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424930, "uuid": "38f2fb6b-cde3-4ba3-9ff4-9711f2009ce1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424930, "uuid": "243cfdfa-acb7-45fc-8594-ae09ecba2c6f", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424930, "uuid": "9b87cef1-3c98-45cb-a1f1-1bbe331215d0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424930, "uuid": "a7026e38-368e-440f-a87a-476233f11094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424930, "uuid": "7129829d-a121-4299-ab39-8df57980770e", "value": "85611eb1feb06c4a98b507edb87a77483080beb6c64b674c6414e036afd44904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ceac9d-9d4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618423946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423946, "uuid": "512fa03e-d149-4edf-bdf0-ca19968ce890", "comment": "Malware payload (AgentTesla)", "value": "cfb543e55ed966b657d418cbd55e409b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423946, "uuid": "534701c1-c7b2-4585-8ff9-2ca9ed1baa83", "comment": "Malware payload (AgentTesla)", "value": "856d50b8956a8d218726db789a078346b765c7591aca39bcd21e30029dbf25aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423946, "uuid": "a8ed3f74-8628-4349-b873-aee870f8f16f", "comment": "Malware payload (AgentTesla)", "value": "dbda70fb6d6f734b996ba771834fc24cb5c1113a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423946, "uuid": "4a242aa2-d0ee-4f0b-904c-d96413677323", "comment": "Malware payload (AgentTesla)", "value": "fbca349133a971143fea16a28b1f0003502c56cfbb4f2b7174f324ead672a0e3a972f68ea4ba3a1187a271bbd0980539", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423946, "uuid": "0467997a-8677-457a-9a24-003c6d26a523", "value": "95050151798CFAAAC56C17BEC04042B1077342A7C355EF8FEC9E59C86AE1382F52D297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423946, "uuid": "fdcc0a59-5a7f-4f54-9e1d-c4ea88692b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423946, "uuid": "5975e7c4-0581-45fb-8697-f0fef9c1bd40", "value": "12288:mYW7mHKAUYs/xIotupKnDB+/YqZb5X22B7zXWhaPSlz4gck9dO4mg:dGRLYVCDkQqZNX2naalzdcwO4mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618423946, "uuid": "056e3680-110c-43b5-846b-cb08e1931eaf", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618423946, "uuid": "47ce92c0-27ae-4c3d-be56-f5997cda3aca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423946, "uuid": "87c69914-22a0-45f4-8d18-ca983bb7c20b", "value": "#10001210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4173ef08-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424929, "uuid": "4048945d-0e33-4ad4-ac18-f586a387001e", "comment": "Malware payload", "value": "bcd8af81d1ea0647c81afe097d083be6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424929, "uuid": "d292325d-d19c-4520-82ac-86efdd165913", "comment": "Malware payload", "value": "8586fbb6959be019978b35d632de1bea507f89f1f85873ea8b287f2d0f821e41", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424929, "uuid": "15a492be-3cab-44a2-bfc7-80e4c9c83e73", "comment": "Malware payload", "value": "074da8feb88205041ddc5366ca504315f6e7471e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424929, "uuid": "dee8f087-8969-4777-a822-2eaf7e143587", "comment": "Malware payload", "value": "b09680a14c9d72819754ead3a9cab1d181a139a55fb5051d015bc74f1059848d4ca29e4a6c20d000f158d4ee9838097c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424929, "uuid": "30f965ad-2c28-43f5-9b2a-31b6868f6375", "value": "90F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424929, "uuid": "7265f5b4-7133-4a7e-ac4b-92924b4120a3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424929, "uuid": "1bcbf0a4-588f-47f1-bd56-bb86c2446ad5", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424929, "uuid": "bafaae20-afdc-4356-bcca-27184b9ed842", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424929, "uuid": "0fdb2322-3c57-4efc-8582-15ef2a179e63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424929, "uuid": "6c045539-d069-4c09-b6c0-6e0e494fa3f2", "value": "8586fbb6959be019978b35d632de1bea507f89f1f85873ea8b287f2d0f821e41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c343c08e-9d41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419133, "uuid": "5708b624-7c2a-410f-ba48-8584b32fbdee", "comment": "Malware payload", "value": "0a218a865aa3d87ed59826e79134f3d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419133, "uuid": "841da33f-2671-41eb-97d8-775544378d82", "comment": "Malware payload", "value": "85c528083c96b1f895ddd73681a8b78caf639b8dcf91eca47ae4e7e7cd3e3540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419133, "uuid": "58b288ad-f50d-4642-b47b-df70831a2ca8", "comment": "Malware payload", "value": "04ee1c53a4e21dfd4df611359012503892977fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419133, "uuid": "7c9acfff-a69c-497a-9da8-238fafdebda7", "comment": "Malware payload", "value": "03da4d505317a95ef1f7dbc3f06168955d97b7d03db5c0b3817ba5813e0879d398dc3c547ed2c46c80e54198dca43f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419133, "uuid": "31571708-b59a-4615-af99-4526ae28e4ed", "value": "D2241297BAC0ECD3EB934477246AA7268778F3530174216B0FC56B6FFA74892950D243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419133, "uuid": "b289ef41-b7dd-4b75-9620-cb4c4c431914", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419133, "uuid": "9ba91675-0261-4ad1-a8f0-76781ff9a2c6", "value": "6144:vd3yWctW/5FGxfHMK76a3wNEqJK2sOkcAbXV0k:IWctWxFGxBGa3mjUGkbbXqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419133, "uuid": "15f66f4e-1f6b-460a-adc5-1a17ee4aa1e0", "value": 229017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419133, "uuid": "8d5acbf0-755e-4de0-ad6a-5747734d4f39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419133, "uuid": "49378964-0d5d-4c1a-9c36-7da1b0868dcb", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e28e05-9d61-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618432954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432954, "uuid": "00c5d6c7-09e8-4beb-b2b1-4d11841fd1a0", "comment": "Malware payload (AgentTesla)", "value": "5aa648ed9fe00a8e2486db2bcd09f0a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432954, "uuid": "0a113dcf-893b-4a5f-8563-3c3c4959e05f", "comment": "Malware payload (AgentTesla)", "value": "8625e20198515d3003559f7c7f56548dbac4919fb0f67f89f90f81f6d926a71d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432954, "uuid": "75b00b07-6713-46c2-a654-5996bd09a6c4", "comment": "Malware payload (AgentTesla)", "value": "f12aefb3a58745452b3ea59aeca4a42cc64d4b81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432954, "uuid": "bb8fc8f4-844a-4747-9017-4cd742f4c895", "comment": "Malware payload (AgentTesla)", "value": "b2c14dcfe2223580dc043a535b225b626cd38e975749ee6da2046d2c7a8f97dcc0901a37dff280455c712be0a2e8789e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432954, "uuid": "210799ad-b882-4566-89fd-affbd2426477", "value": "4B35F092290FB697C56C4E70C48A80F247235D6BDF81D69FF8DDB1980AE4391F40E6E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432954, "uuid": "f9a57156-70ca-455c-a47c-0fa78ea4fd06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432954, "uuid": "a98178ba-b15a-4652-ae65-a6a14fc1a5bb", "value": "24576:mzFKunuIV81k/6QXTg9dlRXiUkF3H3i4Fsg7Kym5zQpQS:m4gvV8W6QXTglRXiDHdOFUpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432954, "uuid": "ed2db85f-9e8d-4512-bd8d-2f772e9e6381", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432954, "uuid": "2aa395f1-23f0-454b-b9b8-4c084c970033", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432954, "uuid": "1c3fb000-9955-4f73-9885-bf38f6ad91e2", "value": "NEW UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28913da-9d67-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435480, "uuid": "f72b01ad-d53e-4973-8a35-0b16340deddd", "comment": "Malware payload", "value": "bc277dbf090781c8b8bf51238b449b02", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435480, "uuid": "8e0c93b9-e8f0-4c54-8b67-2cfe5e80da9c", "comment": "Malware payload", "value": "872c728c38f51fdffc044aab3b5a3b10689d60498d8e1388515f361b1960c1bc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435480, "uuid": "cf677a4b-7798-4036-bd3f-a4d57d2a760c", "comment": "Malware payload", "value": "e37dfab6db73bd8999efe7a31f29b5977a37bc50", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435480, "uuid": "824a26d3-f4e7-41c1-b149-e506c6a60f71", "comment": "Malware payload", "value": "6062c4625f52c7d93164dd9f21fde0db29ad4c40b0236ccb5b04a7b30d4e423f7f3d1241b60dae1705719ccb63249f1a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435480, "uuid": "fc1af05b-262a-499d-a061-4e98a4dce8f4", "value": "48249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435480, "uuid": "41fe1162-b139-4e29-8026-ab66ee62a5b9", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435480, "uuid": "c3485d71-903d-45b8-816c-174e1d22a160", "value": "3072:U0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:fpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435480, "uuid": "1237b8c9-0514-49b6-be3d-80aef86d3df9", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435480, "uuid": "36f23a16-db84-4551-b705-e6d7cc519554", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435480, "uuid": "11f4707b-0125-4dfd-9726-425ed00ae980", "value": "872c728c38f51fdffc044aab3b5a3b10689d60498d8e1388515f361b1960c1bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c71b16-9d78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618442493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442493, "uuid": "bed65126-b479-4ad3-be72-4ddcf5f02d9c", "comment": "Malware payload", "value": "216b8dec1661fffb3545bfaf74e691eb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442493, "uuid": "382281ff-3656-418d-8b7b-0162d9a993a3", "comment": "Malware payload", "value": "8881d37206afb36f4a191e3c00ea6d18c5768dda4f550b6b87b6ba79d7d97191", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442493, "uuid": "4f2df19c-1a4a-4629-b0f7-86951cca753b", "comment": "Malware payload", "value": "7d18b64865c5f61b05c44bc5b96ac15c9711836a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442493, "uuid": "d9022674-9e93-45db-bb07-48a341f41fcb", "comment": "Malware payload", "value": "45e33336a283dfaec0f647c177b8c15f6ba3174dca34f8c8e1848aec5485670f753ab3c9fb231d49e94389e82de58a61", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442493, "uuid": "cb3e2abb-4869-4454-8075-91da4fedac03", "value": "1CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442493, "uuid": "eb75e5ad-505b-4bbc-b524-37e801514323", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442493, "uuid": "53a62559-4dcc-42df-8c8f-b6395b0796e6", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618442493, "uuid": "431af8d7-e52d-465d-9260-858063d2cc76", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618442493, "uuid": "a8a354ac-1d8e-45e8-8e5f-fe4c82bba7d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442493, "uuid": "c4abc0aa-ad7a-4e31-8924-7f6efdbe689e", "value": "8881d37206afb36f4a191e3c00ea6d18c5768dda4f550b6b87b6ba79d7d97191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0814c9-9ce7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618380198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380198, "uuid": "f1827711-db08-461b-bd66-d8ead0ca6dc9", "comment": "Malware payload (AgentTesla)", "value": "735a21caedef4215a0c8e85ef33ce7fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380198, "uuid": "5da485c8-2cac-46d4-8081-69f9e7dd3e9f", "comment": "Malware payload (AgentTesla)", "value": "8891faac068820bce0d45a1fc44d9e86b5d321ac002cd674426bac2a796bafbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380198, "uuid": "bce0c1c3-8124-4390-ada6-4f43dc1b06a4", "comment": "Malware payload (AgentTesla)", "value": "c04a6026ad29a1f5bf92ba9ab389161ab96bffa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380198, "uuid": "31296bd9-3440-4f71-a2f3-4be7b4b6b295", "comment": "Malware payload (AgentTesla)", "value": "32c97e96b5aae96e83da52f9ac3006c09b45e47f6d821e2833a545c1cf689f0511c69db571ed0d2e2da9cbc7407d98c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380198, "uuid": "c29364e8-a6de-4e9d-a934-cdfffbfa6908", "value": "EC42CFAA171AB003B13DA7B6894CC429CE674A255D3D7741283863DA2E90F0EFA604F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380198, "uuid": "2d5d5ded-5254-4fcb-8f1b-425bea4cf962", "value": "384:3xMbPphwMcfEl6IiYfPAjZYfj0MTS4q4R9G:BMbPphf/EwfPWkTV/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618380198, "uuid": "cdc0ab38-e7e3-42f7-9321-44665b43452d", "value": 13056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618380198, "uuid": "66bad253-10a5-4faa-a7ee-487ac1177e7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380198, "uuid": "d2afeedb-38f0-45dc-b8f0-664fed54e5b4", "value": "number 74725794.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4f8a6c-9cf7-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618387362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618387362, "uuid": "608ddc46-3c92-4474-8cee-5d146d7cf073", "comment": "Malware payload (SnakeKeylogger)", "value": "b36b1f3a45732c0ca6d502cae82c5eec", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618387362, "uuid": "4fb220ec-58f8-4e74-a1ff-77f1257ad80f", "comment": "Malware payload (SnakeKeylogger)", "value": "89d440a4a03bba2cb5c8bba7c4f7a9f069f7dfc37c83112cb274f84d85b23c68", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618387362, "uuid": "027c49d5-3a92-461d-9db2-d01ba923b15b", "comment": "Malware payload (SnakeKeylogger)", "value": "d9d29d4229d2d21a9378e7899e82a02acb89c8c9", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618387362, "uuid": "25fcb138-b7ad-43b3-8bdc-a9dc6825143f", "comment": "Malware payload (SnakeKeylogger)", "value": "f4631a5dee9eeab25e1f1c13fe8883abf81d91d895b2e0f40990ad16e31377a491e6751fe8ce797ae3b4c8e97d96067e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618387362, "uuid": "024ace89-2fae-4590-8037-31e3745dca1f", "value": "16A4CF10A6ACF78AD46E57B1C86049311373A25BD716DB1FEC8D20CD4AB4B42F96C7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618387362, "uuid": "259513ca-3606-407d-ac76-5eeb2accb615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618387362, "uuid": "1b85409c-9fc0-4714-b994-cf04740f550c", "value": "12288:4zTyURHtw7yv8g0uZyCoKZw98xGTU2z0BmuVX:4zeIH5ckbK9c2z0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618387362, "uuid": "166acde6-9c9c-49e2-8481-4360f57dced4", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618387362, "uuid": "055b6b4d-7626-4bdd-95d1-7a631aeb627d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618387362, "uuid": "0c6cb5d8-0d6e-424a-a0a1-4bc9a225bcb2", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c4abb0-9d49-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618422246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422246, "uuid": "8adb62d4-edbd-4ba2-adaa-d6e4c6e6d6cd", "comment": "Malware payload", "value": "d7f81b11a4fef76e7a4a17a73205ae76", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422246, "uuid": "7e1c0104-5aaa-49eb-a46a-1a3600c845a9", "comment": "Malware payload", "value": "8b251a7dc3441fe40326138722e66d7e0212495dcf10c36f0fe58641e0ec11a9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422246, "uuid": "6c087544-b885-49fc-937e-23c120c1888c", "comment": "Malware payload", "value": "52f7ccfde32ad570c33ec84019d0bd8838535644", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422246, "uuid": "70d6a845-2ee5-447c-9583-3a190e60f0d8", "comment": "Malware payload", "value": "2ce7f1e05aa9922ad7d40adb964ebc46ff327623745032bf13494c40ab65c42a307631f178cae03e93314cb196271f4f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422246, "uuid": "e839faa1-af7d-4c13-b094-78a29edd3ee4", "value": "1A249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422246, "uuid": "5ace9f07-9eb9-4c55-9917-ad5eb0342347", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422246, "uuid": "f836d4d7-4d24-46d8-a1e7-f8910baa5670", "value": "3072:j0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:CpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618422246, "uuid": "dc2a297e-55f3-49ab-8d89-cf8257d35567", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618422246, "uuid": "d55a57ee-58f3-4204-814b-ce18de8009e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422246, "uuid": "5bd65cf0-db9f-4e05-8c06-4fd6c534f553", "value": "8b251a7dc3441fe40326138722e66d7e0212495dcf10c36f0fe58641e0ec11a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a031c63e-9ce9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618381279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381279, "uuid": "4341dd05-47b9-437c-8a3c-eecf9c95ed7f", "comment": "Malware payload (AgentTesla)", "value": "74173b957e2e703074eef531996348c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381279, "uuid": "808fb221-2198-490a-865a-66f871ff43b9", "comment": "Malware payload (AgentTesla)", "value": "8b2e93f410996ef2b5eac9cc2d686657cb401081ba41f9df156930e16da7723a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381279, "uuid": "e3c61204-8c2c-4b1c-8ebb-135b9a29342d", "comment": "Malware payload (AgentTesla)", "value": "50f377bac440ec4828678f70604d587b168397ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381279, "uuid": "98439e53-46ec-42e1-bb53-9051ecb7d449", "comment": "Malware payload (AgentTesla)", "value": "69c8e30f2e8e8047c2fbbc64be122a695138e30e499ab4adcfcdd445f9d97742cc339c3d10bc328e88998b91f52dc647", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381279, "uuid": "0be088ef-abb0-4e27-b953-ed232279e69d", "value": "9EA28D2A5BD8062EF4B60B32B4F5ED108BF47B4264A2E73FA849924507D230549F5F7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381279, "uuid": "8614e2d5-07f9-43fc-9c34-35b6600559bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381279, "uuid": "6311e9f2-c0ba-4d0e-9c76-538b9321b2cd", "value": "384:53HUFLezwbBUVwlI6NvCtnoLwFWO6btDzHBXPP3nXUtmqYeiJhR4:5MLV9UHKvCtn1z6RzHBXPP3nEtmqYLhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618381279, "uuid": "af72d1af-cf8a-45fa-9053-0475667c6316", "value": 22344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618381279, "uuid": "5067ee39-b3b9-460f-b2ab-2f786d576b82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381279, "uuid": "0568b4f9-9a92-4b4a-9e9a-f2e8d4fcca55", "value": "CONFIRM YOUR ACCOUNT_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5edd72a-9ce9-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618381342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381342, "uuid": "8ff6b2c2-a91b-438e-b16f-f7abf725e848", "comment": "Malware payload (SnakeKeylogger)", "value": "01addb310dd3410e519d273bd1e25917", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381342, "uuid": "0d684590-bfea-49b8-b7c6-445df7cbd854", "comment": "Malware payload (SnakeKeylogger)", "value": "8c2335608b726ce1d430ae88fff8366500fbd86becb6e1c08e4be800aa59658a", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381342, "uuid": "bfcc3553-67fc-441b-9f75-7a3d5e0cb849", "comment": "Malware payload (SnakeKeylogger)", "value": "25434fe0bab54ffde0213f34b3efd2e0cceca4b3", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381342, "uuid": "0d3816e6-0a36-4ab8-bd75-ff42557753f8", "comment": "Malware payload (SnakeKeylogger)", "value": "630be9d8f4da69e9c344fe7f09419ca4c5393585a84c38a326cc9bb551a65079b2fedc54b7b9c69699621e2cf4387164", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381342, "uuid": "e82554fe-cfbe-4cb4-91d0-3c0ff8b19c6a", "value": "7D15F13237986B53E07E533848B2019502F1FD11A677DA4E7DE0758E6AB2B42876372F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381342, "uuid": "cf2b4f7f-fee8-43f2-bdd9-a05c018b4e40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381342, "uuid": "80e1c961-0e91-4972-b9f9-b2355a461615", "value": "24576:eqo5h4o5hXTLGUSMVs8Gega96uHIfNOwIFCscR57V:eBTKvMVs9eJ7HIFOwIFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618381342, "uuid": "ab5ae848-679e-43f0-83f8-37c479e12eeb", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618381342, "uuid": "07bc141b-3d51-41bd-a37d-e219173c8449", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381342, "uuid": "f075586d-20d2-4e81-95d1-98aadd53e9bd", "value": "PO099494949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc14c016-9d5c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430718, "uuid": "8d934835-4d11-42ac-ae33-ba08702ee5cc", "comment": "Malware payload", "value": "677e13457af69312c09a8a24e23d23f0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430718, "uuid": "e6597ea8-b180-4ff6-abe9-9415882c4ca3", "comment": "Malware payload", "value": "8c5fb64745fd9430b06de4a12638a8ca42e79667f8ba2247a56d01d68248ec95", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430718, "uuid": "9f8f3624-9291-4c1a-bd74-ad51e38ddf5f", "comment": "Malware payload", "value": "4aab8fd82fc2c2c4d86201814b70bd6fcef76c04", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430718, "uuid": "aefb7484-810d-4317-90bb-89d5d71fddd9", "comment": "Malware payload", "value": "ace0fecd82d518b9912e95aa023e40d63362570173992065ab23578fbbe1c7929cb2b5136a28dce8dd5c9ca10515e781", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430718, "uuid": "0bf5faf1-4f8c-4065-9d51-4f803a4ba948", "value": "E0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430718, "uuid": "cf96665b-b753-49bc-86f3-4d1f0d2e6cbe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430718, "uuid": "9ee409a2-401b-4a20-af1e-99f0abc710fd", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430718, "uuid": "4d96efcb-60ab-48e5-b8ce-ad6f2485e1c9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430718, "uuid": "4e1fd605-273d-4247-842b-9f0d5abcd173", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430718, "uuid": "f0053659-d8f5-49ff-ac02-5ce1b0b718c8", "value": "8c5fb64745fd9430b06de4a12638a8ca42e79667f8ba2247a56d01d68248ec95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26536662-9d54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618427031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427031, "uuid": "945d1629-944d-4f3e-87e9-64ff5c53fe59", "comment": "Malware payload", "value": "cd4bd26e1674ed9cbc412a1426a2778c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427031, "uuid": "be3abc4e-bfa5-4a93-be8b-ac2a35d3a39e", "comment": "Malware payload", "value": "8cf62b4d7cab59e49c5da4aa4ed9c22ac894aa1faf9ee943b5b016bbf9e5272d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427031, "uuid": "c194a886-5396-499f-a2f0-4cf0402367e5", "comment": "Malware payload", "value": "090d274c21a07ab2d22a41b640150cbeaadf7553", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427031, "uuid": "a9512b43-d942-4ddc-98fd-26c048edafb8", "comment": "Malware payload", "value": "5a7d4b43b09f080244bc299d0c89522cf92950b14a7c93b3b4e33c8aad9a9810d4aecfdfa8a383f0e5c689f3c5e4bdcb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427031, "uuid": "afdbaf90-00aa-441a-9ae0-fabf1906a108", "value": "58249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427031, "uuid": "33f800b9-fece-499d-8aaa-0969e125b9a6", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427031, "uuid": "e4117daf-2f6b-40eb-9b40-d648c6922f74", "value": "3072:90DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:gpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618427031, "uuid": "b5e851c3-3760-4224-8627-c00cfb4f3599", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618427031, "uuid": "827522dd-fc05-4ad3-85dd-2ac935c286d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427031, "uuid": "e7537a08-675a-45de-a414-8d0d2fb42561", "value": "8cf62b4d7cab59e49c5da4aa4ed9c22ac894aa1faf9ee943b5b016bbf9e5272d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0cff9c-9cc2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1618364548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618364548, "uuid": "437f96e8-88d1-481d-b074-b40573b14d38", "comment": "Malware payload (AZORult)", "value": "84416741172c64875fd3a5bf65ad0d33", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618364548, "uuid": "f70f4891-82dc-44f2-9091-a6648c379661", "comment": "Malware payload (AZORult)", "value": "8d5b4d92380ec07bdb8ba955f67217995c5e32580a36f443f5f5b670aa1568fc", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618364548, "uuid": "a306a742-7899-4a0a-b9d7-4da698ba9118", "comment": "Malware payload (AZORult)", "value": "38a182bf622da5a8ba495d4c6abf57733e49520a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618364548, "uuid": "0be617b5-7412-42b6-adf8-59d9b237d3b9", "comment": "Malware payload (AZORult)", "value": "22177ab3200481f5ac50b67328c229f8adbc8039c18f9618a47aad0934547cdde7b4ba8a490832183dbdffa93dfdf8b9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618364548, "uuid": "b9a1edf2-ecd3-47b0-aed4-fcbef8cfa3a5", "value": "3BF30212B7E2AC33EA83DA3165569B3DC7799344211410479B60EF6BFB37B83851B18B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618364548, "uuid": "459c6c68-aebb-4864-98eb-2d385f59ccb6", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618364548, "uuid": "c5c9c30f-a6b5-4c96-9b56-cda90140d392", "value": "3072:HyewmN4skJ63uNjerO72Qn4LJ0QAR10TY1Y0VEPWgZKE8OxfKS:HdKNsOyQnt0TstKPWBE8GR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618364548, "uuid": "3a49375a-977d-418a-b55b-de2c7ec51fc5", "value": 157435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618364548, "uuid": "6c34a4af-cd27-45a9-8ee2-e7a204ff99e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618364548, "uuid": "74383b9d-98c5-4706-9345-cb48d90a82e4", "value": "Proforma Invoice14042187605521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a54672-9cdf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618377124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377124, "uuid": "d6235fc9-c913-45dd-b648-c2cfaae7ece7", "comment": "Malware payload (Formbook)", "value": "18a74ebcd46e9b50e26d770fd28baa28", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377124, "uuid": "88d4c64b-e525-455c-947e-ed70adaca24a", "comment": "Malware payload (Formbook)", "value": "8d77ac5e45a0f443b317f1a717dffd55e98319508cc05080ea006b5fcc93c78a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377124, "uuid": "a5c2d8e0-d830-4395-9767-afd9198ef59d", "comment": "Malware payload (Formbook)", "value": "e3b60ba7545988e92df333202dfe195f948f4a6f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377124, "uuid": "98de2d91-68d1-48f7-ad7a-73c804d97fa1", "comment": "Malware payload (Formbook)", "value": "58562b50d625338bfe27ec01b79d6fdfe06270b5a0c3e4b5795e04a93a433c9b7304cb0dc98e9eb0e145045d0d7b92e1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377124, "uuid": "55e9e67e-e09f-4b52-9748-89b4066e4f6e", "value": "9974CF5173D0C0B2D05324758225C7B18FBEB435A9769ACFAFC90AB85F246D2972A70F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377124, "uuid": "fe98def8-dc38-4245-b5b4-0f1639f88e5a", "value": "0b6968a3728849da0a75cdaf93956fc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377124, "uuid": "d4358f43-4810-49e7-9739-90fade1709d6", "value": "6144:MBufL0rzXQTdQxT0YHyVU8EFc/xsjX/H1Q:MBufgXQJQxIYHzpa/xsj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618377124, "uuid": "a3f186f5-b97d-4a94-81e0-b612aacaecab", "value": 338944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618377124, "uuid": "d3aac34a-e18a-4852-9ce5-ed21778b2953", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377124, "uuid": "139ac152-bded-419c-87a9-18c7f9555650", "value": "85674.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef9e362-9d47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618421623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421623, "uuid": "ed53778a-10b3-47fe-8e36-c94531164b8e", "comment": "Malware payload", "value": "44fc8531046c2e0556c1b7689e6faf17", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421623, "uuid": "c5c90e71-fea4-4b91-b5e8-7fa80ac4c164", "comment": "Malware payload", "value": "8dcab75402a13338cb4be5c0c3a81eacad2d587ee4cdaeebbb54ab43bbe21681", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421623, "uuid": "59b1a702-326b-4e0a-ab1e-c218dddae3e2", "comment": "Malware payload", "value": "d2a670ffa48e9b183a50c20dd1c003a9788237e9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421623, "uuid": "dae42b4a-d5f9-42c7-bf42-ae73354f6ca6", "comment": "Malware payload", "value": "0708c18bf339202e554a383b16a2fa249b42311fce038b49207cf1b6e2404c962121a105dc7f2991f61c52eb68bc7bcf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421623, "uuid": "38bd68c8-1592-4205-a8c2-e710bc31ac87", "value": "D6249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421623, "uuid": "61c15c3b-e8c7-464c-995c-b582f02dc330", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421623, "uuid": "eaf5e919-7523-4a33-8bd8-2a847e4cf53e", "value": "3072:V0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:4pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421623, "uuid": "c98e64e3-80b7-477e-bad5-1d0bccc3b07d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421623, "uuid": "563fd937-c5b3-47e4-9e84-6e7675cfcf58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421623, "uuid": "68c6e2e1-f65f-4194-91fa-57510867e74c", "value": "8dcab75402a13338cb4be5c0c3a81eacad2d587ee4cdaeebbb54ab43bbe21681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3d6443-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425054, "uuid": "85c3c6da-031a-4098-bd04-e1dbb0868269", "comment": "Malware payload", "value": "44f51b05e32203404ca4924cd22e1740", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425054, "uuid": "79b675bb-790b-4af4-abea-53a175826105", "comment": "Malware payload", "value": "8f6fcbc62fb32a19196119ccaa6e45a5eabb8ed2aad233e5ea910dd3e6bde421", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425054, "uuid": "c15b8a86-8503-4226-9c11-b2a4cd7ea3dd", "comment": "Malware payload", "value": "f57f9bf884cef6f79427c49248e88b739fe98aab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425054, "uuid": "8a680c94-4cef-4173-9048-7d4796b1be43", "comment": "Malware payload", "value": "4268fae0ade6429989b87f01c04486fe70850ab45e737b85903b767499016279de493d61f44ecddb160be7f34b696b75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425054, "uuid": "7adc60a0-7059-4ec5-b4d2-e46bdce3b3fd", "value": "7624124BBBE04C3BDE2297B441B3037AC3F554102655926357ADAF667F332828B1B71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425054, "uuid": "175b8a6b-6c6a-40b6-90e9-73707a3fe6a8", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425054, "uuid": "e6d67e83-fa4b-4ab1-b03d-f35c03049b18", "value": "3072:HyewmN4skJ6kA+6O9VRqIO9pyB9UyZuh9wnVduupLYZWYe4KyuvMuj64thLWGtNo:Hdq6lTyBRp+mMZWYRKyXujxfiGtNIN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425054, "uuid": "2e0f37d3-261a-4926-aa2b-33ed311abef0", "value": 228066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425054, "uuid": "9dbc21be-2003-4af0-9485-b0d5615cd45d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425054, "uuid": "5da42a96-729e-4a02-b527-5e85f6b64be8", "value": "Material Requisition for Quotation (MRQ).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59a3241-9d68-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435968, "uuid": "7732a47b-9909-41b0-810b-4f33a7fd4988", "comment": "Malware payload", "value": "6079a695e262f2e96e4239a38727482b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435968, "uuid": "556d5897-2eda-42d5-bf55-62b351cb7f84", "comment": "Malware payload", "value": "8fa15aff1a1d25f40a0bc99abc96bb7fc60b515d8c9c47f14704a557f44b9fb4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435968, "uuid": "6d80065c-cbc7-40f5-9820-b7f95b7a4c9c", "comment": "Malware payload", "value": "6310b393a8c96ade12499cd9f12e4cca4e3ceefa", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435968, "uuid": "5417a5d6-217e-4c7d-b78e-62d6e9367f40", "comment": "Malware payload", "value": "2ccd034e0bd23fde19827beeecbd3c0658ff820ed4603378e87a0a9c5b7dcf29f485b0257fd548c11221ec3353977de8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435968, "uuid": "a202651a-3dab-4dbd-8c0b-825d448ac978", "value": "FE249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435968, "uuid": "cfc48cb0-711c-456f-bea5-2a28033351f4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435968, "uuid": "d6269d7e-7f0c-480b-95c9-5160671fc0a8", "value": "3072:j0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:CpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435968, "uuid": "7245c372-131e-4e2f-9b77-dc46bc14f818", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435968, "uuid": "e1f3ed49-d3f7-4ae4-9464-01a57dd6d2c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435968, "uuid": "79bfb2ee-128e-45be-ba01-f207055a9918", "value": "8fa15aff1a1d25f40a0bc99abc96bb7fc60b515d8c9c47f14704a557f44b9fb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac48bb2-9ce2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618378049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378049, "uuid": "70124abd-9701-40f0-99d2-7926bd5766cf", "comment": "Malware payload (AsyncRAT)", "value": "08a4958f6dff6a1fa153eee727293963", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378049, "uuid": "a4182497-c5fc-4668-a7e5-e4e7bdb430ea", "comment": "Malware payload (AsyncRAT)", "value": "8fcbc9107e8b5c1d96fafa754d05b8230f0ed660381d930f215d04e909fc6065", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378049, "uuid": "624e37a8-8e1d-4a64-9803-ae2622cc8663", "comment": "Malware payload (AsyncRAT)", "value": "fd370d10a3d195fdf358a478e7468e71c1d3755e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618378049, "uuid": "79ed2895-6101-42b6-8aca-b28a0ab4b3e2", "comment": "Malware payload (AsyncRAT)", "value": "1509c7fe830e37d77cdaca34987875419c0449900d7ee2473797492276695d797dd9d68e6d1bcb95a5136d23d4226820", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378049, "uuid": "7fb5bf47-8e92-4666-9234-083c9a30c1be", "value": "77D4E061AA6CFADBC95D13F5C84006B547B34397D356DB9FEC8E50D886E0382F9182A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378049, "uuid": "7a344509-c7e7-401e-b4cc-74d6fa63350a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378049, "uuid": "e52ed77a-1f42-4dd9-b09e-c4e87d7da254", "value": "12288:65arHA85bTRd7Pjm2ZarRtpn/uyMaf91lJ/gW:k8nbb7Pj5yTGyxfDl5gW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618378049, "uuid": "e6af92af-befa-4962-af4a-6e722f8fd4ee", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618378049, "uuid": "e5153f2b-ca98-467f-af90-2b47b0374295", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618378049, "uuid": "08165c87-f877-48d4-8e76-f6e2e38e5947", "value": "SCAN COPY2539976864PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5408b83-9d3c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618416962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416962, "uuid": "652164ec-66b3-469c-976a-5ea2f5a37307", "comment": "Malware payload", "value": "d8ded8263ce1b30d9e018de8a1b8fcb1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416962, "uuid": "2e19d2ce-2e44-4444-bb7c-8d6cff404971", "comment": "Malware payload", "value": "8fd7755890ff71165917c34dad9af8afd5084e901f026f2df63e7ad255b07e50", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416962, "uuid": "3671c244-22c8-4385-b7bd-f192e31ea1e7", "comment": "Malware payload", "value": "51ad1d3c885c9b84f34fd73e98241b4698be1dec", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416962, "uuid": "1776f998-52d7-4bb5-a676-faf8b39c5f1c", "comment": "Malware payload", "value": "52437ca704e7c11eeee856cf69fbea8d5c6f6da447be3f7515db07ce299ea4e69ed738a5117b4baa9674b850845f49cc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416962, "uuid": "a219aa6e-b7e2-4b0c-afd5-4b966d8063fd", "value": "61F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416962, "uuid": "93746e7c-59b1-4ffa-bd3d-45a382ccea3f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416962, "uuid": "164f7692-0569-4dd2-81c9-e821f41555a4", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618416962, "uuid": "a41ed401-9796-4903-a4eb-0fd030efbe8b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618416962, "uuid": "91b3f4cd-ef02-4921-bda4-74313ef4a5b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416962, "uuid": "0c918979-219c-4084-9f95-4de2560250e4", "value": "8fd7755890ff71165917c34dad9af8afd5084e901f026f2df63e7ad255b07e50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f62d398-9ccd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618369010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618369010, "uuid": "e1ce7521-e3f2-4a05-aca5-f12a2601ab10", "comment": "Malware payload (AgentTesla)", "value": "abde830772b027154cbbda6851c6d57a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618369010, "uuid": "f75bdfc0-83da-47c1-94da-690874c9088f", "comment": "Malware payload (AgentTesla)", "value": "8ff800deec70982677dbdaac741640a160feef437b25455ceb86728305c037e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618369010, "uuid": "161f75d0-715f-418a-9f02-24798e0ca483", "comment": "Malware payload (AgentTesla)", "value": "0179ca31738ba487688138a06e988a9a76c8ee78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618369010, "uuid": "c9445215-8cc0-43b0-b0f8-6921c8f07d20", "comment": "Malware payload (AgentTesla)", "value": "9bd5d482e6938b7b11b8c1a962e1abd4b3cea03b7cc1ce25fe14d2fe4f980ef7376720100db3807304e0c06c8353cc71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618369010, "uuid": "797c1ae9-11cd-4314-a4da-d7256b7609b9", "value": "6A55152C75049AD7C5AB03F6A32C4C0092F59C4EA6FBF64DE8873DAAB6BD740B125147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618369010, "uuid": "cdc94a91-d96a-4cac-9d7f-656a5338af19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618369010, "uuid": "48103f1f-a1df-4ca0-b42d-25b5095a97a7", "value": "12288:1R/hyKwq6hLRRRJ/psEn/S4ZSq/GkYXnzeiWSP/MEyGMVn/K/dd6E7YmgO8mgr:AKwqO3pN/auGNsS3ul47VhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618369010, "uuid": "ac1112f8-725f-4b92-bb48-413cb9f0c98c", "value": 1325568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618369010, "uuid": "d3457aaa-b0ad-439c-93ee-e0e21c236e32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618369010, "uuid": "a5b1da6f-3d56-4e3b-9b2c-93b33734c8c5", "value": "REQUEST FOR PRICE QUOTATION.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e6619e-9d5e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431613, "uuid": "5b24f481-3265-4f3b-8da2-5e5288048317", "comment": "Malware payload", "value": "a44a26991dae4dfc0654e87bd34d93bb", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431613, "uuid": "da6a5df8-308f-47e2-bb38-fe164d90ae24", "comment": "Malware payload", "value": "9022407e4992237e4427d16345d4e6fcfa9bc7b42fcfc3a715f6b92d2a396446", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431613, "uuid": "ab1a82b1-23d6-44b8-a024-ccd2a7a2bfe6", "comment": "Malware payload", "value": "316bc05cf070763298e0a98aeb6d26c49452d421", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431613, "uuid": "9f385cf2-fa30-4990-ad3d-5aa01ef187b2", "comment": "Malware payload", "value": "aad904b786cb19f45d274d3bbded9324ca507d8802c7576f244bc7f7f1f4c2343a386bd84a3a705a9e40b7f41fe46e20", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431613, "uuid": "fc536e5f-08b9-4868-a93a-107e9d47fa9a", "value": "98F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431613, "uuid": "4b8ce81e-9954-4232-9ff7-b59c1440438d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431613, "uuid": "5bd2f3f8-f5ae-49d2-8381-ba46bdd720bb", "value": "3072:zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431613, "uuid": "c03556b1-b3ea-4ed8-b3c9-79fd74fba032", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431613, "uuid": "fbb2f50b-b593-451e-930f-b1d585b68836", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431613, "uuid": "db3f8b6d-34d3-45bd-bb37-80a91be969fb", "value": "9022407e4992237e4427d16345d4e6fcfa9bc7b42fcfc3a715f6b92d2a396446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0953bab0-9d7b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618443732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443732, "uuid": "336c7511-30bd-45d4-bbbc-cbf792adf0b9", "comment": "Malware payload", "value": "94285c67b47092ca8787e5293bbde3de", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443732, "uuid": "cae5f477-125e-4d0e-92a3-aa687c9471d6", "comment": "Malware payload", "value": "90308c2b9041a8e33a38b4c785d90c8a5d2431e2503b30080c1eb4408478fd9b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443732, "uuid": "b70b1447-4d5c-44d8-a129-cbbd177703cc", "comment": "Malware payload", "value": "ad5e0a5529c4967144bef532b84e635664662f98", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443732, "uuid": "413a89f3-de2d-4bb6-b826-e117e97aa62a", "comment": "Malware payload", "value": "c8e9d860d3d3c1c0ce94d169ff1007c207cd9d4ef74c96ee671e7d3e250ceea6d96c2a187f6ff9f30eaba4507d848269", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443732, "uuid": "7d25d990-c479-4924-9f3c-6ef675027d39", "value": "1E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443732, "uuid": "5b44818c-1448-497b-9b1e-a4aada6fcca1", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443732, "uuid": "df91cae0-04e6-4c77-9195-ffed0ffc05a0", "value": "3072:u0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:tpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618443732, "uuid": "88e01cab-ef29-4f22-b159-eb11a962427f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618443732, "uuid": "259a72b5-757a-42de-a800-8c1967a0dd78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443732, "uuid": "e275cda1-5c22-4866-b127-cb141d1d598d", "value": "90308c2b9041a8e33a38b4c785d90c8a5d2431e2503b30080c1eb4408478fd9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcba25e-9cf2-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618385030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385030, "uuid": "35b8ebe1-48a4-4d73-b4de-5b8b5fb9db8e", "comment": "Malware payload (SnakeKeylogger)", "value": "dc654ca7c570770398c1a893b59d1457", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385030, "uuid": "6618f3f2-1a9e-44b6-a422-50dcb30545c4", "comment": "Malware payload (SnakeKeylogger)", "value": "9073a5f8dcea52e05c44cc9731cdd02c2568a6b6a54c1f6f2ee738b3c1bac5f5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385030, "uuid": "ff6059c5-d750-4e92-9365-c8c1bd839ce1", "comment": "Malware payload (SnakeKeylogger)", "value": "68d55f7a393506b3b4a7f6accb18919da1a22c47", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385030, "uuid": "7fe2f5b7-8139-4d7e-a42a-bec13bea3c51", "comment": "Malware payload (SnakeKeylogger)", "value": "4ca703a835fb84c0b885b77b3b38fcfbb7d6d92995165aae486b05b61dca5fc94ef151d9e27e113ed765f14f38903484", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385030, "uuid": "0d75fae5-5531-42ed-a7ae-f12eeecf9f1b", "value": "BB8423A6E23190C5B60E80D92377472E5EF67075AD04BE89025A2F4837B9D9B74332DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385030, "uuid": "497ef34b-3866-4c66-9c2b-e1f5287b8ab7", "value": "6144:+IMdrU+XR14Y6iuN1Yw7lY7wm4y+ErT3bjkxE8HNYEmhCMaJGK/:wC26JieOff+qnjkxEoTmgJGK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618385030, "uuid": "64c556ff-775e-4b56-b3e6-d33520fcdb1a", "value": 371039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618385030, "uuid": "8c3f34ef-6a5a-4375-ad9f-f607d69bfcd7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385030, "uuid": "dda2b6c4-e3a4-4f90-b776-9c0099672431", "value": "order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2890c5d2-9d4c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618423598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423598, "uuid": "b1d85249-890f-47b3-84e6-6bacf7ec79a9", "comment": "Malware payload", "value": "8c3ed7431052e7981085145a2bf3f36b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423598, "uuid": "ee46aa7c-6d89-4239-8389-a625cfeb4b03", "comment": "Malware payload", "value": "90ba3773a9036fe1c743821bd321f635c9faa41840762d8b40c0145e7d98b609", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423598, "uuid": "ff3c31e2-a19f-43ac-aa55-6b672a80ea13", "comment": "Malware payload", "value": "c87ea56c420b659e0f5481fd9a72901a3d4e0114", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423598, "uuid": "d5d2f810-5a55-4f27-bd47-70a0dcb069cc", "comment": "Malware payload", "value": "06cd8080b346a1bbb6c20176e4315cc867813b9cce5d222461e6fc2d179413032220b8035ebb75fed31276b0eb05e4b6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423598, "uuid": "447fb535-20ab-4cb9-8a76-f380207ef030", "value": "DA249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423598, "uuid": "ede209c3-0776-4f83-a724-5652a1496a80", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423598, "uuid": "d10a2299-cc4c-4e18-9a02-1e223fb5f67e", "value": "3072:J0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:8pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618423598, "uuid": "aff52d8f-bbbb-4ae4-ab1d-b550b9bc2342", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618423598, "uuid": "e9d2f901-7022-4964-a874-fc92644da7a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423598, "uuid": "7a830316-6a55-407d-9d3b-94157d65684c", "value": "90ba3773a9036fe1c743821bd321f635c9faa41840762d8b40c0145e7d98b609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e525db-9d6b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618437011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437011, "uuid": "5feb5995-dd9e-4567-98d5-cec5a62d54fa", "comment": "Malware payload", "value": "be9b68e06bd7fd2fd234544647d940d8", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437011, "uuid": "06db5f57-f457-47f4-a8bd-91cf5c5eff32", "comment": "Malware payload", "value": "9128894294791f88432267c9a830255497b1e59622a186eb28edee77cb97d057", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437011, "uuid": "ae4b2e3b-8342-4356-8436-3f710e0b070f", "comment": "Malware payload", "value": "a6c88d9c031ae6a7a185463fcbd180d2577444b4", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437011, "uuid": "4fe844ed-d698-4ba5-8c3b-3bd280579644", "comment": "Malware payload", "value": "e7d5f8303044d41c52ec0474e5dd781601fa537456751d16d3c807677a9712c5f6e525a4bdde1f594864080a20be6bfb", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437011, "uuid": "56fb9fd5-c1cc-451a-b7b6-c01dd7ae2882", "value": "94F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437011, "uuid": "577d125f-00a1-4a1d-a8b7-21aec43dd311", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437011, "uuid": "8a76364f-2999-4fd8-9012-37fd1414526e", "value": "3072:klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618437011, "uuid": "67723534-7e70-44b3-bd43-83b2555c7efa", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618437011, "uuid": "ad051cab-5e9c-4794-a380-4493b20e6396", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437011, "uuid": "4b9a5707-9e43-415b-892d-e3c883148bae", "value": "9128894294791f88432267c9a830255497b1e59622a186eb28edee77cb97d057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb2c5df-9d5d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430880, "uuid": "b5c23b21-fd20-4552-9919-19e524db27be", "comment": "Malware payload", "value": "ba1b3697d265ec964860490d76ab99c6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430880, "uuid": "0489b5ac-4120-4a44-9665-7109007dd2e5", "comment": "Malware payload", "value": "91ec677d7aad9a753a42698de2d340108159b248e731ea05b0ca80685f639fb3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430880, "uuid": "a59a98a5-1c7c-45fe-a377-92b74666621a", "comment": "Malware payload", "value": "cc76513cb3445f3aaab4b3a0cced776174b12f1c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430880, "uuid": "c51f4896-80d2-4336-9ba9-d0be16d6902c", "comment": "Malware payload", "value": "d4728990db238d8b5266fbe1d7ee0b082a4dadd98c5b373f8babca5646f9ec6b072ed530c7eb2ded3523cefda97f93e3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430880, "uuid": "36e870df-5ca6-4169-9d03-e19acd74d173", "value": "EB249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430880, "uuid": "dd6c4872-336a-411b-8712-3d9650978fbf", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430880, "uuid": "c02b84d2-86d8-48d8-b9b2-63cd360523c8", "value": "3072:h0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:0pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430880, "uuid": "216f9116-cc3d-4374-b04b-54aef1cbfa2a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430880, "uuid": "982dffbf-e45c-4ae9-af7d-09d20a260993", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430880, "uuid": "87973390-abb2-45b7-aec7-7a7f719fca43", "value": "91ec677d7aad9a753a42698de2d340108159b248e731ea05b0ca80685f639fb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75bb825-9ce4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618379143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379143, "uuid": "8042519b-b2e6-4362-b9a3-05080c3886b5", "comment": "Malware payload (AgentTesla)", "value": "60aecd4f0e9d227cce1dc224860b46fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379143, "uuid": "a8b88525-0ff3-4a87-8023-4be53a533022", "comment": "Malware payload (AgentTesla)", "value": "93a737cc189070b141d3dd8a4564c1ca18c4d968b5a25383bc3011d803e64e89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379143, "uuid": "160b3c8b-df50-410b-8836-a56a332b5308", "comment": "Malware payload (AgentTesla)", "value": "afa061ce2beaa213a6fee9a0a93a646be65b4318", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379143, "uuid": "597e2c0f-bdfa-4b0f-a12e-29be3733d4f4", "comment": "Malware payload (AgentTesla)", "value": "5a074e5ffd731a8559f45ed52864054ad8522bc8ffbc33dd97c107bf915a38e6d4be10310ea40e5971b03e090b9daef1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379143, "uuid": "4f80b355-58c3-4ce8-bb6f-bbcf6e22b549", "value": "3C257B1E23D46A35D3FD8F769862A400CBE4D61F2E16D6572DF8DDC870BBB10860DA4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379143, "uuid": "90b9b7ef-9392-4c89-b2fe-75fb68fe6c0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379143, "uuid": "bfda911f-ddde-4994-83d6-02a06febfdee", "value": "24576:Ht5V3dAe//SB2coMuFT6tjRTbDR8CdgLlCn3UcnnQVjns2isFxE3QCH+ayhIiFir:Ht5V3dAe//S4coMuFT6tjRTbDR8CdgL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379143, "uuid": "074a9c60-cc24-4c03-a20c-9274f54a199e", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379143, "uuid": "d79f9534-89c2-4c59-b96a-373f4c416e06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379143, "uuid": "ea110f8c-6f5a-4793-92e8-f7a67499ef46", "value": "block.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d897c70-9d4d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424090, "uuid": "a8b6230b-7de4-4879-af3d-a9b3d7eac60e", "comment": "Malware payload", "value": "f350af31626c76927f1ab1939bd45460", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424090, "uuid": "ccf75606-6327-4700-b5bd-f5a12d8cf4c6", "comment": "Malware payload", "value": "941ebfbe620b784375fbca80708198401015a0b05dffe447bab88151c0f61d13", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424090, "uuid": "16b86d8c-3665-4b06-9f5f-ff1dcf264915", "comment": "Malware payload", "value": "88e69efee1714cbc10339dec5f7e78e388c7f915", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424090, "uuid": "3ee99e48-7de6-4538-a332-d5f8cdad71be", "comment": "Malware payload", "value": "cb7835d5c672c787737a2f98fd87fb25d903d723d743aedb58ffbf8feace497f5b358e599cfc8568d80dc17fe50152fb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424090, "uuid": "3f5774da-03ad-4b3f-862d-9e1e10f90c68", "value": "6E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424090, "uuid": "f1024053-aeca-4258-b3bb-fbf94a32dd7f", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424090, "uuid": "479d9e45-dc8f-486a-ba87-57e21f75da9a", "value": "3072:m0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:lpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424090, "uuid": "5dab5784-2d2c-4b22-a6ad-e4ea9c9df88d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424090, "uuid": "8dc73273-6f5f-4760-ad90-8862f7857bd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424090, "uuid": "ea4ff7d6-6ead-4949-a3a2-0526116bcf97", "value": "941ebfbe620b784375fbca80708198401015a0b05dffe447bab88151c0f61d13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e519f658-9d47-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618421767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421767, "uuid": "6a9b32b1-54b0-44e4-b324-bbc3805a5a61", "comment": "Malware payload (AgentTesla)", "value": "610dd31d63fcda01c65d378623e4ba70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421767, "uuid": "5e9aa474-3112-4172-8e70-4a8ffa74cddc", "comment": "Malware payload (AgentTesla)", "value": "948f6ba96f0836e315c051f216f4bfcd51f03c3df4e9221c59263bd98319d8f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421767, "uuid": "37068cb8-c4e5-4074-98e2-675928385233", "comment": "Malware payload (AgentTesla)", "value": "fdd21995c04814641208ce4d2b02f330bfc3ca3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421767, "uuid": "49e10269-69f7-4fbb-b2c1-098fdfd52f41", "comment": "Malware payload (AgentTesla)", "value": "520e07c409187b32ab774fec28799e699570d9c0fcb03f92e0eb3bf452b8ca8813a17353c11eeba5923745cd85f2e72d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421767, "uuid": "c0f4e145-48bd-47ea-9a83-12b5dd0b7520", "value": "7CB4231172D804BCBF97E0E056A8ABD620D6329FB875D05D0536F55AA91222F3BF3F09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421767, "uuid": "b4ef09c5-e8d1-479c-988e-e5b54cdffca9", "value": "6144:iDq8v4z707qJ/2OnhepvP7ydLOtD1+jbtaHWrzkWlna/6XHbKXvrFX6M1Y1dP2dw:iDqjP0mAOhgv9ZlWIiXH2frFqo82dudr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421767, "uuid": "0a953785-cfc2-420c-87b5-9be0dc3b689d", "value": 502015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421767, "uuid": "2d7b5ece-3594-45d9-9370-68dd80c8d538", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421767, "uuid": "5ea7b551-849f-4325-b13b-4266d893e351", "value": "Comprobante de transferencia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2455ccea-9d68-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435617, "uuid": "e14eed2f-9c44-410b-9d78-aef78735cb6e", "comment": "Malware payload", "value": "25f02a5b746a0318620ed687979e7f78", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435617, "uuid": "89bc7272-3bce-4f20-a681-01ac8e2f9c76", "comment": "Malware payload", "value": "94932ac91126356eeac50f531b4b3d2c1d3d6c3944989585a0fa566fc3f1c1e6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435617, "uuid": "9b1a4bbf-14f1-47fc-861f-52f9435b091e", "comment": "Malware payload", "value": "517d9eee3d1fbb683c1812c9ea525fe7605a8b99", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435617, "uuid": "f2404726-eb9d-449c-955b-4305726504ef", "comment": "Malware payload", "value": "7e6622ab33185e177c8aa629367435650f21d00855821cef60655afb9c82ab2877bfd512216de00cb983e1dbceb87aed", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435617, "uuid": "40e7a6f3-a41b-4a87-9de0-6035215f17bc", "value": "23249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435617, "uuid": "53e6bee1-7277-4370-b8fc-293c7434b336", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435617, "uuid": "29da170d-a67e-4ff1-9676-8b26aa555203", "value": "3072:30DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:2pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435617, "uuid": "e9b8e16b-d4de-442f-ae6f-8cff6e2edd0e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435617, "uuid": "64ec1d3b-17f6-43e8-b6ae-8ed1ed88fa3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435617, "uuid": "a11dc9d6-b4bb-4617-aa3e-cb919b7d9a32", "value": "94932ac91126356eeac50f531b4b3d2c1d3d6c3944989585a0fa566fc3f1c1e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606ee5af-9d38-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618415102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415102, "uuid": "d790fb34-af2c-4e3a-b601-bf0a11771adc", "comment": "Malware payload", "value": "e60dbdedeb4831b6c08a155c2e7def1a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415102, "uuid": "e356c5b0-0435-474a-849c-8234bcdf43ef", "comment": "Malware payload", "value": "94a2c4b0f6bdeed5c2c3b0170e31471971b679ab27f2c1edf3ef47fd7d87d543", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415102, "uuid": "e8281072-583c-414a-b2f3-a33875a3e9b6", "comment": "Malware payload", "value": "eec75fff7dd5fca1a0a5a379971434737b302721", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415102, "uuid": "2f9d60e3-9f7d-4b78-a66f-4733681debfc", "comment": "Malware payload", "value": "eface0f39df333e3e3f0fbaf0da726e15893d37720fa5718a9a69b9ba9cf99cd6633177f907766aad765609ac1829cfd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415102, "uuid": "154dc9b5-efc2-4e42-bb23-d2946551c6c2", "value": "99E423CA44C093BFE6220D6CB3A696541C740047EBB04C3A214E5A19794E76EE7F7F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415102, "uuid": "72209f19-4d78-41e3-8dfc-9b9a95741470", "value": "12288:ZRZk0Jkb/HnLKs2rzBpID28SVcQCAJVFjDefNb/TPTVBs7dQQPRe/l9RzAm4FR7z:ZRZgX2rzjIDsVcfAJfodLBa7qpN9VYRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618415102, "uuid": "fffa366e-4102-481e-9490-cb46db0fd8e0", "value": 722752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618415102, "uuid": "f9bd6766-e698-4485-96b1-df3dfac864d4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415102, "uuid": "f5066d58-a970-4be6-81d4-bb7aba8f61c2", "value": "Quotation.xls..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66b0b87-9ce6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618380135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380135, "uuid": "82513dfe-ebcc-421c-a2c8-d4db5151104a", "comment": "Malware payload", "value": "4c7807bc0a3f0723ca2407126c37a873", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380135, "uuid": "ec0558be-9ed3-4394-b448-fe3cf7c82869", "comment": "Malware payload", "value": "94f33cf383d937228ec8dda99b55e8cf2cef7725757cc591036264f11e6649fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380135, "uuid": "0d0f279e-a67f-4983-92ce-f8b813ee60cf", "comment": "Malware payload", "value": "9812b6a3333803282a393988bb556d14ca9b58d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618380135, "uuid": "ad528541-cf00-4ba4-8555-1096c2956e3b", "comment": "Malware payload", "value": "8e05076be83b42c7f6792e1e2d77dffb5b3d0f9d017ac6620eb08f7f63be377f34bb6b42e30fb9b968825091be133773", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380135, "uuid": "7d874a86-ce4c-4578-ae8d-ff419ab15afd", "value": "62842342EC7F7CC8E1B5D3872DC64B36C40369AAEAF7E46DD328985395CA43468CE442", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380135, "uuid": "faaa22f6-ebf8-40f4-a6cf-e57d9b26a935", "value": "6144:11K2Ge6i8cWaSuuwaM8m5lYq7tMruwcx52+xSQs9HQVqf1CVbc+I9A4NP6dL+2rQ:l6i8muS9lNtMrXcnL4rHIez9A4MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618380135, "uuid": "6a39df17-c96c-4472-b7da-c4a5b8384346", "value": 402317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618380135, "uuid": "93a9c0e6-ab74-427f-a3c6-d5bbfa5b15a4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618380135, "uuid": "dca9cb0e-ce4e-49da-95fb-c09937558cee", "value": "PO_36571_VIC_Pty_Ltd.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e0c3b7-9d5e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431535, "uuid": "a08d26bb-4093-4a5e-b246-00b0b84bb77e", "comment": "Malware payload", "value": "d8efeb2e1ead503d2b8d18f1ba627e49", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431535, "uuid": "0d07557b-5337-44d6-8baf-09cf5703b8c5", "comment": "Malware payload", "value": "9586e241b4a2bfc63cce79b295fa9af80fa0fe0603d5605ea6bfbba107262486", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431535, "uuid": "856aaa55-8dbf-4b35-b689-466085520470", "comment": "Malware payload", "value": "953fa2ce31296a0016bdb4fcd0ce8fe8adfe4958", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431535, "uuid": "de468f80-ce36-4a24-a749-0f3837eafd8a", "comment": "Malware payload", "value": "ce6d1a8917af4e4a82cf85fefccbf8ce989bdd0ddf299fb6e63372be1853e84736d9ba73ea92b0c87953fbf6604b1183", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431535, "uuid": "38989cc8-bfd0-454b-8add-81b08ae4cd16", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431535, "uuid": "47080011-b95b-4838-827e-4fa5643a186f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431535, "uuid": "5b49a8ff-8cab-481c-8fb5-22792422617e", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431535, "uuid": "79a8260c-3631-47cc-a8df-5b6a28fe3d1d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431535, "uuid": "c61ff9b1-8409-49be-b1a4-1e585618c9ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431535, "uuid": "f41628a3-517a-4174-9c21-62ae0ca09514", "value": "9586e241b4a2bfc63cce79b295fa9af80fa0fe0603d5605ea6bfbba107262486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06360b4c-9d3e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618417528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417528, "uuid": "4a97a7cb-3602-4730-b2c3-3bc3121e36e7", "comment": "Malware payload", "value": "0c4894abda675667af363d6711bc877c", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417528, "uuid": "19b560e9-4a92-45b8-89be-6f8f89e7889b", "comment": "Malware payload", "value": "95c5a8d414164918918b5bf7df12a41ccac098f3f114ddbc5f45d9a43d631f39", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417528, "uuid": "4f3bd098-c1f0-408b-b5ff-02b36e5a609a", "comment": "Malware payload", "value": "a67675e8e3cf6fec401fa045037a32e9778cb527", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417528, "uuid": "66ca990e-d5b7-4bd7-9bd9-45cb10934c55", "comment": "Malware payload", "value": "3e472a5fd50a61e2a20a76cf5425eeba84ee72f271bfaa280133e31498e15197e30e84cd0f4a4cae118e6b7fa04beaf7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417528, "uuid": "ce33a6b8-cd61-459e-aa75-7062bbe8e790", "value": "BF249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417528, "uuid": "660f4f21-2aaa-456d-aeee-4a6b8ea97e94", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417528, "uuid": "4cdcdc3c-b639-4bfe-9d5f-4e3277dcc413", "value": "3072:90DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:gpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618417528, "uuid": "b3a2fa69-5690-4843-be22-ceeec98b4c8f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618417528, "uuid": "d8e0eb4b-b91a-42c9-a1bc-e153a60b6957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417528, "uuid": "6d16818b-83a1-474a-a991-b7a64858e3ae", "value": "95c5a8d414164918918b5bf7df12a41ccac098f3f114ddbc5f45d9a43d631f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc004bb-9d76-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618441644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441644, "uuid": "23e3a165-ca99-4bd9-927d-1bf984425c70", "comment": "Malware payload", "value": "16c0b8f7d008be5014639bb0fb142026", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441644, "uuid": "84e4a280-2fd0-44f5-9571-adc5035e36ee", "comment": "Malware payload", "value": "97809d8bde3c695ec767110209ff2315398f9aa437ba955402f0c73a41e81454", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441644, "uuid": "fc5df89c-a941-4117-bf9c-194e92a5a82b", "comment": "Malware payload", "value": "0f6041681537932e601d1f5b388d7211aad6124f", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441644, "uuid": "490a21ab-8562-4f36-b1f7-2c08690ac27f", "comment": "Malware payload", "value": "021467ac03e5b607a3bc1ef2bf51ba34e102ba61af963a4a79811916cfff55380e9034b202fd861bf20190f7d9efb0ae", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441644, "uuid": "aa5454f5-8212-47be-bd8a-f0055ab208e5", "value": "01249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441644, "uuid": "6f6075a8-4a1a-4607-a7ef-06d547f368cb", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441644, "uuid": "59e3d6d1-e4e9-44b3-974a-c68a05d8544b", "value": "3072:H0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:mpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618441644, "uuid": "5359d9b5-c3b6-4a7d-9c63-033e50afd0ea", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618441644, "uuid": "75f4ee95-6af1-4c5b-a722-344bf2372aa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441644, "uuid": "1a1ab578-f0ff-4d0b-ad58-94f0b5a3f063", "value": "97809d8bde3c695ec767110209ff2315398f9aa437ba955402f0c73a41e81454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6257292f-9cee-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618383323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383323, "uuid": "ae87f86c-2dd8-4882-a26f-7dd023821b15", "comment": "Malware payload (Formbook)", "value": "1d752735ac96170442bd75b8a7bce8e1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383323, "uuid": "2f94f8b9-2843-4bf5-9115-018f19d5e522", "comment": "Malware payload (Formbook)", "value": "98dd51b637719916b1ac360fbdf222c7fddccdedc8c2c80a7e587791a4003417", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383323, "uuid": "7030fd3d-439f-4a32-81b6-be59a2542588", "comment": "Malware payload (Formbook)", "value": "4b0f3c1bc19034cef1780bc488a635a6f669ad44", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383323, "uuid": "687fef77-d963-44f8-be45-3cd6f13295e9", "comment": "Malware payload (Formbook)", "value": "cc0e88370b3ca03220e249b0d4db1626feaa5269892d8f50afceb77826476a00f8217a30360b6c98a1b25f0175a10679", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383323, "uuid": "cca7769a-63df-4ffd-b433-565f3944ff48", "value": "D20523DB7E2964EF4E5A4704EA1D952FD96148F871BD25B9092C0975AC23B2CBEC0F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383323, "uuid": "4dbeb1e8-883a-407c-a39c-4a78dc4c5c3a", "value": "12288:mox6nkWrwrZ6+QnrRxv7r9qFNUEqLa042zQfVvYba30rIxo8J8kn5ervGrM:TM/cl6jxv7rEqGx4QP5ervGrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618383323, "uuid": "2f0f39a1-91f9-4cd1-a924-c809318da42a", "value": 831013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618383323, "uuid": "55103b1f-b180-4148-b0ec-978c15e431c7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383323, "uuid": "49055759-ddaf-4263-854e-4340772a270e", "value": "QUA-2021-A0010-B-01-2021-04-09-14-13-51-548 FT Quarto-doc.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e44fde-9d30-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618411758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411758, "uuid": "98912772-cf38-48c0-b900-e4e5645a76f0", "comment": "Malware payload", "value": "769c8dac63b99144fbe89aa826a2b639", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411758, "uuid": "466b7df4-ecf4-45c0-ac88-16d849802196", "comment": "Malware payload", "value": "995b79b392f776256fae8b08ad1db073bbd5c369ca8c282999f1e85fd48c340c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411758, "uuid": "bb5ce343-4573-4bc7-9117-e24ef96da725", "comment": "Malware payload", "value": "8defab0d167b882dac70ac1c0bd1ddd96cbe4e4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411758, "uuid": "8a450c1b-0d59-40da-ae81-e5bd35ab3a62", "comment": "Malware payload", "value": "808becd04b55cb9be665583d121329e946c0860d3c33aaeecbe90516c17279c7ac7543b9ad7e162121230f3fe8481992", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411758, "uuid": "e8bcfa10-eac6-42b2-92de-f283b78d9878", "value": "B0930228E6F25127DE75647FF6134DB22B1A3401B371995B3480849A8CCE5F386BB8DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411758, "uuid": "56ae44b2-1daa-4f1e-b239-d1ef982b9e85", "value": "1536:Lsgmwe/goi7gPHjPPLIW+7osUJ4kfeeTE0hJMcPmaDpdSu19ihOWi:Lsl/u7gPDMH84kGf6JMcuaNB19oOWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618411758, "uuid": "f4818eff-dcc1-409c-b09a-203d07a5a4e7", "value": 96451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618411758, "uuid": "18228fea-cedc-462a-8aed-c5060255e959", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411758, "uuid": "db332fe8-176b-4129-90ac-f112160bdfe1", "value": "documents-2136656015.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0db8d3-9d69-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618436409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436409, "uuid": "0df28b94-630b-42a4-81cc-17f192812d2d", "comment": "Malware payload", "value": "0980afef2d646085ef1aa9f14cf537eb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436409, "uuid": "2e81581a-d1b4-4330-a7ab-f26dbb383a57", "comment": "Malware payload", "value": "9a06ae10355cb3c8655bf7eadcd159fbd194afb5bd6288ee251fee0b158b8a32", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436409, "uuid": "c6091a8c-44e3-475a-b713-0e33365b1678", "comment": "Malware payload", "value": "a7013707c5233061cbb1dfe8e968d64f0b9f189e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436409, "uuid": "c15b2c9f-f6cc-4efc-aced-f015a456f58f", "comment": "Malware payload", "value": "0c4ad1da4f99e8b2b2a72d8e5826e139e70745081ddc1263fedbb58c1ceb19ad6bd957c935ec7557b287f409f3872e27", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436409, "uuid": "13320faf-92bd-4f04-b0ff-dbd2ef6691eb", "value": "BA249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436409, "uuid": "6d5c3744-3968-4eb0-ae83-0e2d35bf2480", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436409, "uuid": "68d66f76-152c-4446-83cb-8ce15845594b", "value": "3072:20DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:VpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618436409, "uuid": "1773ea9f-686b-4122-8463-fade81851b48", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618436409, "uuid": "de2dc249-680f-41a0-be93-5252e26f64b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436409, "uuid": "67ae613d-9f3a-4373-ad51-7ac6e210c86d", "value": "9a06ae10355cb3c8655bf7eadcd159fbd194afb5bd6288ee251fee0b158b8a32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41af4d9b-9ce6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1618379832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379832, "uuid": "a95b1441-9d74-427c-87a0-e44ddadf2c96", "comment": "Malware payload (Mirai)", "value": "0f8e28ff48d5f11575ac890472319f73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379832, "uuid": "925c38e7-1ef0-4c76-8385-60a1a400dd4e", "comment": "Malware payload (Mirai)", "value": "9bb73bc9981ee9bdd3f0f628b0e727b6bf8ac06240e56608517487667a2e9f51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379832, "uuid": "91bbb045-125b-4129-affe-60436babf2a8", "comment": "Malware payload (Mirai)", "value": "bfb9da620022d5ef6a7e24de5705b054737a7d4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379832, "uuid": "19a56f8c-b289-4380-a7bb-56b7c7f2b29d", "comment": "Malware payload (Mirai)", "value": "b5d4fa937270cdffd1594930b69fff2120f6bd87def25a81a1c084a9754362a60cd82d8516046c4c4f3870d8b2c825cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379832, "uuid": "70aa20ee-0bd8-469a-80c4-c864eea8a2c2", "value": "59A3291355B287ABC94662F16ADBA521E023FC3D1B7A2207F7D47DD43B31CDA2D99280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379832, "uuid": "e9f7dd68-8068-46d3-a74c-a43b3b41c91d", "value": "3072:WuSTqbWptHLmSL53Rpha0hJv7cNxydq6kWONEm:WEutHqYhpha0vv7cNxydq6kWONEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379832, "uuid": "1f2c1676-7465-4472-adfb-8a2008ea50e2", "value": 107257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379832, "uuid": "5ca835c5-c8d3-47dd-badb-37d01e1a13a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379832, "uuid": "c077a6dd-3059-4392-978f-a2bfd352ce4f", "value": "ArticNet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e428b3-9d6a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618436482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436482, "uuid": "faebb0f0-8738-42db-9479-5a813533e0f2", "comment": "Malware payload", "value": "8bb5729845317d5345830ba8361c9a66", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436482, "uuid": "967c76b9-ad02-4406-886d-04cb5e5255c6", "comment": "Malware payload", "value": "9c96828ba0bb40fe6e287a47a63e5834f1959784e67a5222adaadc818ea5ae25", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436482, "uuid": "9e80ef66-1b80-474a-a0f8-b28f8d253e96", "comment": "Malware payload", "value": "e4afec68da002f223968f49ab0b3234605ffc176", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436482, "uuid": "1c31dea3-7762-4dc4-9518-66a768292526", "comment": "Malware payload", "value": "0b362f55f5c2ad07d11821f009ef8cea64bf594e0bc3b3a4f655d75f27f79424f1d23933632e2ddcc51e2b88ede4b9e4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436482, "uuid": "b2129675-69de-40f2-ab69-f9aa3e686663", "value": "F2249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436482, "uuid": "aeed4718-4319-45ce-bbfe-ed3e8bd106e0", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436482, "uuid": "e8f83dea-1934-4373-860b-c8cd12a5b75c", "value": "3072:M0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:3pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618436482, "uuid": "ec0e4fbe-04a3-4905-ad9d-16b93ce238e4", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618436482, "uuid": "9b02a588-c102-4903-a85c-1a1d2c91867e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436482, "uuid": "ac601313-7aab-4800-bde7-a8fb4206f258", "value": "9c96828ba0bb40fe6e287a47a63e5834f1959784e67a5222adaadc818ea5ae25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af1c617-9d60-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432139, "uuid": "5c63f2a6-2b58-44f8-9aa5-89a2f1aabcea", "comment": "Malware payload", "value": "7ab7e0481e83146dbecbd72a297b9718", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432139, "uuid": "c9bbe354-d628-460d-bd73-276e11fb6a04", "comment": "Malware payload", "value": "9d952876e686bae45db66226aee0c3f68952101eead299fce9b9e2da4420f3a2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432139, "uuid": "ea3249bf-2cd6-4cf8-b8e8-2f46e9cfae50", "comment": "Malware payload", "value": "c6e066c902434cb6ae039845ed9dc7ed2f490653", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432139, "uuid": "2bf1f7e3-33fc-43f6-8862-37264902f2fa", "comment": "Malware payload", "value": "62ba373169426ead877f755ee842dad12cc73240d4ca79117af9f8b0c399648c796d2a900d159d469e1b8afe28a6d9b5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432139, "uuid": "bdf8f073-a906-4dec-ad14-59370ade2c7d", "value": "AE249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432139, "uuid": "ed9f5ff9-5c6f-455b-be2f-b11a3db2441f", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432139, "uuid": "db2f6098-0525-40e4-9b8c-4fd534529750", "value": "3072:a0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:5pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432139, "uuid": "70e33225-9c63-49a5-b9f3-2c14685ab891", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432139, "uuid": "8c73a581-d2f2-448d-a91b-7edc399b592f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432139, "uuid": "6b0b0d9e-0b0b-4d47-aa1f-d2ce4a8bfce1", "value": "9d952876e686bae45db66226aee0c3f68952101eead299fce9b9e2da4420f3a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0228d7-9d71-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439737, "uuid": "a3c5ed98-ca7e-425c-ad48-25642fe5596c", "comment": "Malware payload", "value": "d0cd3c60659eac53162b85e57601f74e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439737, "uuid": "79293e70-9e98-4b90-87cf-92190da96bf5", "comment": "Malware payload", "value": "9df08256af46b6522ee83d1b6f71ba279426a140dcbdfbaca12dfdd42fce43cd", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439737, "uuid": "bbd701ed-c221-4a73-8daa-9c4e39ddacf0", "comment": "Malware payload", "value": "8bd6819516cc25b4531368fc070f543ce97ce9ae", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439737, "uuid": "9399977b-14d2-4b89-a4bb-af297d0694b7", "comment": "Malware payload", "value": "780da18116fd7dc071c94a6ba01292dabf6222a42765f5a3d23c75cce0f8d810898db7f54107f59629899b7fae58afce", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439737, "uuid": "6af040e4-8bea-4e88-b9d1-9d1717e33f02", "value": "65F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439737, "uuid": "038a04b1-3f70-489f-a69a-114a46909558", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439737, "uuid": "06c3e48e-1359-4a67-a711-b5101f8dff67", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439737, "uuid": "76130734-0f8f-4b20-a37c-20cefd77d824", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439737, "uuid": "4cbbeace-f01d-481b-aa5b-9bd095e6b3c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439737, "uuid": "b14ca1e3-d215-4008-89d5-2168db0685b9", "value": "9df08256af46b6522ee83d1b6f71ba279426a140dcbdfbaca12dfdd42fce43cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccc8b23-9d65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618434504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434504, "uuid": "dd935245-a94b-4752-8de6-a8b25156942a", "comment": "Malware payload", "value": "b04def9f10c3ad1da71d2c3e49c4e138", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434504, "uuid": "2f4b8d2e-d357-46b5-a785-551a0eb4b4a6", "comment": "Malware payload", "value": "9ea28b6a687a8caec98cddac94529f517fd7b3ab49468acc32853930d0ad4ef3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434504, "uuid": "f1686f58-9105-47fc-bf1d-0c238bc217fa", "comment": "Malware payload", "value": "2ea198b3a7fc85dc12ebcdabbc46dad5ec584d96", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434504, "uuid": "64dac14d-c8d3-4573-9133-ed927aee9d27", "comment": "Malware payload", "value": "b3566296c9806a7b042bbfb5f396c1d66690bd3597bb24178e3cae5d7cdedb420b8b23fb9be3976c8cd959d6c056f7dc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434504, "uuid": "47b5a0c0-243c-4e0e-858a-bd1abec16f65", "value": "3A249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434504, "uuid": "cecc8d32-a1d6-47b8-bb16-b41cf2ff9c53", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434504, "uuid": "85d34b38-0c98-4bbc-9af2-4abc9bf9a82c", "value": "3072:Y0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:zpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618434504, "uuid": "7537a56f-d216-49d4-83e5-7f58a8c1269d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618434504, "uuid": "6ffe1c3b-6a2b-459b-a88d-63760d800d50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434504, "uuid": "77f4cc0f-87ed-443a-adf2-a5b574dd126a", "value": "9ea28b6a687a8caec98cddac94529f517fd7b3ab49468acc32853930d0ad4ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee27b93-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425085, "uuid": "23e27081-bb87-4270-ba17-a28b2f02b625", "comment": "Malware payload", "value": "ad538c3330b5cce95db4e32fd3de8e9a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425085, "uuid": "872aed86-25bb-4d20-ac05-315e3d3632ea", "comment": "Malware payload", "value": "9eea2ae3f3200db886bf865381d62d7c4bf5415755cb4cc5ea8b055c94908c06", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425085, "uuid": "4ee12c70-2644-42ff-9c0b-eca20fbb9026", "comment": "Malware payload", "value": "c51299f38b7f040bfac4c9f1c29f2c3c769ee7ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425085, "uuid": "6c01e6c6-52fb-424c-8837-91bde0c6fd9d", "comment": "Malware payload", "value": "305681618eee09bf2f315e4affeb67894309a857ab5e015b8759d7c6e4663f16d3803e286953c87b3f273e47dbc3e64c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425085, "uuid": "79400ce8-0f3b-4509-9bdc-b5ed03c5eb17", "value": "26A4DF106ADDF789D4AE17B58861463123B37327D766CB1FAC4C60CD4AB0B42F9683A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425085, "uuid": "6177d29a-00aa-4ae6-86a6-4e345ba43feb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425085, "uuid": "d3200111-39f4-4b56-96e2-198328522646", "value": "6144:EP8plbfsvXkvN71EWzeze2CPAS0kgrmC0jNGAsnaWSBeDECdqcQartFxIQf6rjgp:/iGN7eC20AwgyCIcaWSkXdrdBigp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425085, "uuid": "6bc46e6f-7ec4-4086-8e63-f469a366516c", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425085, "uuid": "4930e3c1-61b4-4c19-931d-4182dd5e1df2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425085, "uuid": "c8e6586d-e6e3-44fc-bb50-92c9d728a5ba", "value": "PDF Order 01920 FILE GIDA SAN. VE TIC. ANONIM SIRKETI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c882e8-9d78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618442698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442698, "uuid": "7a28fe92-632c-456b-832d-572cbffaccd8", "comment": "Malware payload", "value": "9d954b59b2440d530cb12e440563a2a6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442698, "uuid": "aee5180c-ae07-499e-833c-b97bd7b80d87", "comment": "Malware payload", "value": "a01d4bfc1b545bd90856e7e9c69de35d3525a389b6c0db04ed03311e39f56b0f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442698, "uuid": "02f44e11-a31e-4fdc-b8e8-4b44509f3b02", "comment": "Malware payload", "value": "44552e316da24514f126e777dbdc22db7a609ba8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442698, "uuid": "5b1c36c1-55af-4460-ad99-b4ab536abd07", "comment": "Malware payload", "value": "777b1e136c5317ca43f8aad542870a12166ef0eead8cc50aff345b4eb7c005a5ca9ecb0412fc945dd806cc6b0a571d48", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442698, "uuid": "562b97b5-f48a-4070-8a14-be0223f61909", "value": "E6F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442698, "uuid": "a3cb1e2d-d11d-49a1-9314-5371d75f6d3e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442698, "uuid": "5facaa07-4be6-4943-ba3b-cd5ffc60255a", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618442698, "uuid": "3e130860-ae5c-4b08-a282-140561aa7f97", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618442698, "uuid": "fb892894-55fd-404b-860e-bc978e1514b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442698, "uuid": "9d024054-f5ca-45bc-95d4-a2b5f5e7ebe8", "value": "a01d4bfc1b545bd90856e7e9c69de35d3525a389b6c0db04ed03311e39f56b0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a217fd-9d65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618434336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434336, "uuid": "3f40d791-6937-44b6-89a7-02481ce11f77", "comment": "Malware payload", "value": "248d3d9639938562db0dd7879a06df8d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434336, "uuid": "37ca5696-9aa5-4426-a03c-f93a0d6b5312", "comment": "Malware payload", "value": "a2573243c086255a59e9b42f5c86020e25a1e5ce610fb9616a72afe642e8383e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434336, "uuid": "0b99d8c2-0f2b-4884-b7d7-5f668f2d085a", "comment": "Malware payload", "value": "043678041a2971c9032faee3eb81fa444f1ebea4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434336, "uuid": "85844e00-2c53-494b-b889-d303c78479ff", "comment": "Malware payload", "value": "150d6fdd189c3e5f7a49b93b2db8085641a0916ea3fe7937f0c02e62f089ecfcb532a3e91eb7fa8ceff25ffe207fee44", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434336, "uuid": "d5e72d2f-aaf5-4de1-871b-14e22cafc175", "value": "92F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434336, "uuid": "4f0fe436-8855-424b-ba0b-667ad5454ac2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434336, "uuid": "cb202893-2a3f-48ed-afd6-1a7ff2f9e99c", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618434336, "uuid": "7a0c5b31-7054-463d-83ec-3e32a9029b35", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618434336, "uuid": "5e048812-1d5b-446f-b6f6-ed53926137b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434336, "uuid": "871fc676-abce-4357-8b66-0d53c8cec4bb", "value": "a2573243c086255a59e9b42f5c86020e25a1e5ce610fb9616a72afe642e8383e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8f0631-9cbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618363393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618363393, "uuid": "2454b7d5-0b7b-4b47-8e90-98eaebcb0db6", "comment": "Malware payload (RedLineStealer)", "value": "4f1894725d8fa09d71de52cc4b6a77a4", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618363393, "uuid": "1f13862a-7425-4bae-92c9-c996808a110c", "comment": "Malware payload (RedLineStealer)", "value": "a3c09bd3e253340a22d86ddcc71b8a5bfb8cae31b5fbc38fcf8bee9804dcc58a", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618363393, "uuid": "9384f00c-f027-432a-a03f-2600168dd57f", "comment": "Malware payload (RedLineStealer)", "value": "2c9511da8a52e64fc8b728770d5eae7b471f2a24", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618363393, "uuid": "c4ba17e3-cdd9-41d9-865b-2787446a12a5", "comment": "Malware payload (RedLineStealer)", "value": "6db9fbe391390f1cdfe17a0a28debf20e2f60a48abff688f94f6865c4b09ee22ca649e603df3fba04aafbd4e6a8ac6d5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618363393, "uuid": "26f53b8a-4640-451d-8895-ad6743010761", "value": "CE15BE4232C8D999E07B6BB1187EC15013B5BD4EC631C60E3F82AA1E59F37421567BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618363393, "uuid": "a4cee393-9b0d-476f-946d-4486f385af36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618363393, "uuid": "c18aefa8-d169-4d28-87ce-5bbc3f33ba7f", "value": "12288:e5lBKjVUgdciA0t89doro8O6IZpuV/hiRgQxf9OSiyyjK:qmj2gdcfy89KroN3pE/hcgUfQd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618363393, "uuid": "b2a7dd37-c31d-4cdf-98f5-83838247d228", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618363393, "uuid": "6972f5ae-9334-494a-9643-e40a940d21ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618363393, "uuid": "be6571ca-7946-45db-9e9b-295c0a0de8a0", "value": "DRP_QUOTE478595969PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdd72b3-9ce1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618377816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377816, "uuid": "e332a787-f698-4bae-93ca-55c735a7ba47", "comment": "Malware payload", "value": "43285acddfc056b3a73868f1e512c0cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377816, "uuid": "301b0b33-679e-4c84-8fd6-b28a727c8786", "comment": "Malware payload", "value": "a5340a8d91c751eff3cc9d1fd6c673c1730df92a04aa7ed6b7e72259d0f3bf12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377816, "uuid": "73c446b4-372b-4fbf-8a07-9e45d36c0500", "comment": "Malware payload", "value": "b0bd545d1d8b47344cc1c55428eff137a1e12fdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377816, "uuid": "492be85f-4889-4034-8eb6-43e3abbf4d7a", "comment": "Malware payload", "value": "528177c24727f895175f506ed208c4e921162d405de4727edb2599c5bd9932da145e89be022117ea5318c16396388808", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377816, "uuid": "0b7e2f86-9f2e-4d17-a1f6-5d26e51c8829", "value": "CA142907759089FFC4D68FB426DBA0218D33F4390B366206B794FDA92F0DE989E5D294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377816, "uuid": "eb377de0-48ef-488a-ba6b-378bedf489ff", "value": "6144:UCGT2MbfhPF8f7muNZFRTL96VdAC+kNwybET:UCGyMQmeFRTL96VdAC+kNwybET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618377816, "uuid": "4ef5b813-a70c-4b2a-b046-a2b6d654780e", "value": 196844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618377816, "uuid": "5f997168-c2ee-42c4-a6a4-6253e1637ad5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377816, "uuid": "6866d1e2-6eeb-496b-9942-7b862ed80ae9", "value": "zbotx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a567afa-9ce5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618379417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379417, "uuid": "bd9b11da-66b1-47f8-8fb2-10726e73652a", "comment": "Malware payload (AgentTesla)", "value": "d028fd092e4060c597c0a0ca16a5a82c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379417, "uuid": "7446ffe8-5f00-40c7-9855-d80a8ce9319e", "comment": "Malware payload (AgentTesla)", "value": "a79cd2afe6fbd88f394601ec42877ca66fb58a0844c3838abd1e2063fe7b07ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379417, "uuid": "94df3f47-3aab-40e6-adcd-60f81fbfe59e", "comment": "Malware payload (AgentTesla)", "value": "2dfde8113265922ada58baf639810f51c9fa3db8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379417, "uuid": "db4870dd-a9ea-4a1b-9817-b9946d06b936", "comment": "Malware payload (AgentTesla)", "value": "b92354af0f4212880572c659d177abfda44be9c15b8539cd4ccabdbd2fd808e946b42294e33fd6a56c1457cdaa444523", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379417, "uuid": "224491ad-b5a4-4442-acd1-69cd25c24bcf", "value": "AB258D1227D56F05E73D8F7294226030CBF5EE463D1AEB972DC43DC971BAB109912E1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379417, "uuid": "12da2bc9-aa4c-4cf1-8642-fb0776f36f4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379417, "uuid": "e28956cf-6682-43ea-b035-6195a94a2ecf", "value": "12288:xENO2iD7hpEgiEXMP1VXUrZHdlg5IZeRqTwq383d19SBKW49WsH2:S76HEX1SrZHgIs3Xdd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379417, "uuid": "1c9afa45-8c45-4a80-80a6-8c0fdcead0bc", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379417, "uuid": "85d2138f-41aa-4f72-b327-2f07e11f449a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379417, "uuid": "97a596fc-fb13-42a8-84a6-93e0406368e2", "value": "RFQ____22701608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c9d713-9d41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418861, "uuid": "3500c983-054f-40f1-a2b7-9e560a8b3d7f", "comment": "Malware payload", "value": "b183ff5d4277fadeb9d0fbf235e5885a", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418861, "uuid": "d90c98f9-9446-491d-a6e0-97ce6cc575b5", "comment": "Malware payload", "value": "a79f60aebd0f2c456f54ee9d64575ced0093deadef3c533ef9a67c55a0c3f6ac", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418861, "uuid": "b10ef87f-7b09-4a1c-8a93-5e69ffa99d2d", "comment": "Malware payload", "value": "0066ec10d68bb59bc729c58214f2ecc13a53cb7f", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418861, "uuid": "8ebca0c5-4f0f-48c9-b5d8-19432ef87de8", "comment": "Malware payload", "value": "9c1a77e7d5f8fa5edd79d86b63e923e5ccbe6731ab05b389433fb86331b0ea5822ae45d8529b682881db27bd1c832020", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418861, "uuid": "0305cd1b-ffe1-4ed3-bf43-d728139ffa59", "value": "0DF423477396A08B0B83C83E6EE7AC7777D10DDEC5616FCC960B81B806748B4912F9A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418861, "uuid": "fae48f16-4a71-4c54-add9-89fcf430b835", "value": "12288:qx+goKoI1nKTitAKHdGtB5XPD3pTc5DQaqkV9eMfHEK7m+T8M5i7ZzSB5JC0Owe4:OnPt1KaAOktB5dc5DQbmoMF7m08Ms7ZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418861, "uuid": "453e0ca6-a573-4ff3-a6bd-3fa382d9c0b4", "value": 777899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418861, "uuid": "1e3f0e0d-fc44-46c6-afe7-861172309cf2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418861, "uuid": "59f7d6bb-26eb-491d-93b7-238c63c50864", "value": "Invoice 08574.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e2e24b-9d45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420581, "uuid": "f5e87cd9-53ec-4dfe-bea8-e4e581db0d52", "comment": "Malware payload", "value": "390ecf268e4bdb26f89b2522ec160b15", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420581, "uuid": "aeb90786-ec23-4348-a6ad-a8ed77f5cae8", "comment": "Malware payload", "value": "a819cb0dafb123bdd367daf6ea21ffaf4ecbff11b7fbf4875db84b0b998a7975", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420581, "uuid": "95a1fb2d-453f-4a1d-97e0-82dc1c0623bd", "comment": "Malware payload", "value": "593ed690103170b70cc744cc2478332d7ec1f1f4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420581, "uuid": "c0768910-5e39-44f6-9c51-851a1075206d", "comment": "Malware payload", "value": "0c5141216b7bc1e0b1efdadfdbf86bde963bae65777ecc6631a25acca5840e6f7c6f9d5cd73cf3c3b479f93d3df16ae6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420581, "uuid": "5391269e-f5d4-46c1-9647-9bc5cd89acd8", "value": "E1249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420581, "uuid": "100049ec-405b-4558-b148-bb129a1dc3b4", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420581, "uuid": "8a58f4f1-93a9-433b-885a-7905e68d1ff3", "value": "3072:g0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:bpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420581, "uuid": "4193aca2-a2ef-4596-8727-8f661ecb8378", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420581, "uuid": "b7469cf0-e7b4-4113-ab97-21df57f8c616", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420581, "uuid": "424704a7-269c-41f5-a8bc-aed385aa3a5a", "value": "a819cb0dafb123bdd367daf6ea21ffaf4ecbff11b7fbf4875db84b0b998a7975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688d2cef-9d5d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431007, "uuid": "73fbf68e-3b32-4f77-a5ea-bd5e5517d680", "comment": "Malware payload", "value": "a8520120160bf0ed2d5f1a62ccd0a2a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431007, "uuid": "5f2f9239-d500-4a26-bd7e-ac666d6d2d7b", "comment": "Malware payload", "value": "a86d574b0b47c886fa1c8e31a0e4486d53398d58641c4c04ecdbf80e34922e33", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431007, "uuid": "b715fe1a-da9e-4219-bf68-4e244463df43", "comment": "Malware payload", "value": "ddf74b46aee71d32e31e66aad8b3599a5512eea5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431007, "uuid": "3466bf37-9ec7-4083-9b6f-cb2daed1967f", "comment": "Malware payload", "value": "ab80b608591d1a8cf890f72afc6900e9c118a65c4cbec265598dd322d53b6bb71262de0be2b7401efa4d05c687ba47b4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431007, "uuid": "bac596a4-70d6-4c3f-a99c-2578fcb4fe87", "value": "B854F10F2544C94DE8061E30556E36380BBB7FDA2965DF49FC4BB6ABCFF32846146226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431007, "uuid": "750da54b-72e6-4574-991e-eb4e501141d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431007, "uuid": "3090ee80-1e68-47ba-b169-3830ce75daff", "value": "3072:756cV2pQGBReTr4X+VGRr0mjOH9zeAx6V0rcHhS96uIMQAfjQdseKbxF8WJSRgtB:IEFXr4n0maHkAx6V0uu04SsF8hGV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431007, "uuid": "c7ba64cc-0b32-458b-9f37-d7096443345f", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431007, "uuid": "c7be8eb1-5a4d-4959-9f76-f01072ca8e26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431007, "uuid": "e9b7f95e-67ee-4b8e-b8b9-6c286ceee2fb", "value": "Kqslz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ed7049-9d5c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430682, "uuid": "cd3c35d1-7ca2-421a-9b53-dffd9682dc6b", "comment": "Malware payload", "value": "7155578d9a06056b4f506a0241fc8309", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430682, "uuid": "2b8adf53-3f05-48d4-814e-edb73b2ffa1c", "comment": "Malware payload", "value": "a8eaf42ffc8fb78e6214124d20568fc4321b42e901ff5628159c3d11e8a45fad", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430682, "uuid": "a5b2cfea-2af2-4cec-8e58-b42d61c8d289", "comment": "Malware payload", "value": "12ee04fd19eda63be87d580416ee4fb28d06bc95", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430682, "uuid": "46c70a31-c1e0-4b29-b4f2-74a4933db222", "comment": "Malware payload", "value": "9ee05cbfcfc3090856687149aae734a4547a58a747e7027967e994ed7c4907511eaa95f2cd7a56ad3e06e4a505367698", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430682, "uuid": "d5a5b2b8-60e6-4986-bee1-9857415fabcc", "value": "D3249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430682, "uuid": "1deec184-f6e9-4491-88fc-b7f808be3b78", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430682, "uuid": "04858882-23a8-4b63-b5e2-a5e71821cf7b", "value": "3072:w0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:LpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430682, "uuid": "5eb33ce5-8498-4c42-b8a5-47c68bed11f7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430682, "uuid": "0e4f1c7e-1b46-471c-88a9-d30070452222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430682, "uuid": "5539a8f6-15fa-40e0-8286-d0e9cc6d7ce5", "value": "a8eaf42ffc8fb78e6214124d20568fc4321b42e901ff5628159c3d11e8a45fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d837ff53-9d62-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618433342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433342, "uuid": "5307b122-b43b-40c8-9dcf-9876aa1d05fd", "comment": "Malware payload", "value": "31db3473a93ac2831bd895b0d83154ec", "object_relation": "md5", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "v4 macro", "colour": "#129A89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433342, "uuid": "d7c87931-718b-4a84-812c-ebe327dbf22a", "comment": "Malware payload", "value": "aae2cf00546070edda9898e8439236bb06001d46d2649d8a859a5952bb5229dd", "object_relation": "sha256", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "v4 macro", "colour": "#129A89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433342, "uuid": "97486057-2011-42ef-a6cc-354500cce2c0", "comment": "Malware payload", "value": "aaef0d7e0bd4094c0ecbc19c69cc85954f209820", "object_relation": "sha1", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "v4 macro", "colour": "#129A89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433342, "uuid": "a0abf7ec-d795-4aed-baaf-74e530af1c9a", "comment": "Malware payload", "value": "00df0a902e0d24c77b7bfa0e898470cc77a88860ea6e521d8f85b8fe7393866cf14f42680775c476ed1c6f058f9de117", "object_relation": "sha3-384", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "macro", "colour": "#F3B5D6", "exportable": true, "hide_tag": false }, { "name": "v4 macro", "colour": "#129A89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433342, "uuid": "2a8f4d70-50c7-4c06-855a-289b5df2cf9b", "value": "7544CE17990A99C6F27D01F8F9064AED6E093B09F983BEFB14605FD57A751070E8E03A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433342, "uuid": "1b87e781-adfc-431b-9e76-f96a8410b6eb", "value": "6144:bzM9ddiSmvmGv3VPuEv6uUEXFpI+OgcNCcehKq:bzy/iZX/MEvT/Vq8csFht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618433342, "uuid": "82c11801-69ff-4d40-8014-111c5ef76efd", "value": 260685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618433342, "uuid": "91cc03a1-51dc-4887-a45a-7b1a0bc6971a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433342, "uuid": "eea5a08f-69bb-4d8b-b239-9eafd968f62e", "value": "subscription_number.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ee7db8-9d5e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431509, "uuid": "7cde1607-f730-47f2-8f72-771a3241c707", "comment": "Malware payload", "value": "1d45f806ddba4a452f3a1ffd14a6b4be", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431509, "uuid": "90175cd9-9f42-4b31-8e8e-9898bc94b084", "comment": "Malware payload", "value": "ab37ee1d9678447e6971ccd4f8c588f16844aacc8f9277a0cdac7b1cafa9e03f", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431509, "uuid": "e5e90b06-6414-4806-aeb0-e7a8700303d5", "comment": "Malware payload", "value": "401773e049a4b93201442752a7f45c8ab2c56616", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431509, "uuid": "c33baa58-5037-4cb0-b4a5-e4d032e639c6", "comment": "Malware payload", "value": "966ed3d8d60ce7bb21ae623da2340d6866f69ed8ec35aae49f4f67ec23d2cc51c615381863aa576426d8bd7c9813d949", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431509, "uuid": "92fb98c9-18f4-41b7-8bad-bee35936aa44", "value": "90F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431509, "uuid": "df878e53-4d35-44b4-ae55-b014b8a99d73", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431509, "uuid": "ca1ceaff-5a56-4ccb-a652-c73f5e928af8", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431509, "uuid": "865348eb-3b12-4296-974e-2323847bc158", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431509, "uuid": "7bb96eaf-443a-405d-a3f8-85036d3b1de3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431509, "uuid": "a9eb5d25-37c5-450b-a6fc-8f6dbcd31a26", "value": "ab37ee1d9678447e6971ccd4f8c588f16844aacc8f9277a0cdac7b1cafa9e03f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd88910d-9d62-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618433405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433405, "uuid": "0e42b18b-44ec-4d64-b125-829be6a380bc", "comment": "Malware payload", "value": "cd88df9d5101571962ac5bff609489df", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433405, "uuid": "ad8e4d02-1630-479e-a160-25c09aa817be", "comment": "Malware payload", "value": "ac97047d8efb1539164c7698dde140f8dd52341b8e108ffc5954e011bffb2763", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433405, "uuid": "d065dcba-c2ce-4f59-ac4d-7cff612faeb7", "comment": "Malware payload", "value": "022e76dc57b7d3ffd6b11c675809b2e8408df407", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433405, "uuid": "0a9f8092-8005-4a76-91b1-6c13e6096262", "comment": "Malware payload", "value": "8084ad32908041893a1c048910880162f9424e9a126e0a27717a2a9057596522ea18a7274f0ea25f747e17705f027d89", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433405, "uuid": "ab033667-2ea7-46bf-838e-77e99ee4416d", "value": "FF249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433405, "uuid": "8f3b6064-a37a-44ad-83d1-c77a8e994bd7", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433405, "uuid": "c265422f-7cdd-43bd-8dee-96e10408b73f", "value": "3072:g0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:bpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618433405, "uuid": "ccd8e7ac-0e10-45fb-b8ac-e8e3b27785cf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618433405, "uuid": "b1cbaec2-8600-42cb-b094-087de3840494", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433405, "uuid": "4ecdb05f-e4e0-4db8-93b2-8f705a5a5717", "value": "ac97047d8efb1539164c7698dde140f8dd52341b8e108ffc5954e011bffb2763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4350a8eb-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424932, "uuid": "7eed1425-804c-4340-8002-7bb3369c6cc8", "comment": "Malware payload", "value": "cf3e228f72bedd9f8ce2b5bb4738b1bf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424932, "uuid": "e981101d-d9f9-4cdf-bb63-3fd37f430098", "comment": "Malware payload", "value": "adf19cfbcfafc08e282180663e151b372beb363652a93433f11df9cde6d65e9c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424932, "uuid": "84cb3afc-52bc-4e3e-8e5a-7ca059e64bc1", "comment": "Malware payload", "value": "b0496c3026a4e34a9431d36d6567481f253a3f5e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424932, "uuid": "7f4606e5-a67a-44df-b155-69b8b7469ef0", "comment": "Malware payload", "value": "c44e2c444e26a77beb988e409f19f097401bd383551d1b9998838019db382b09598a7d2e319309d3bdc351d2e01bad2f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424932, "uuid": "885762ac-5352-490b-bd92-7cfb8509b7db", "value": "4EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424932, "uuid": "60fdd3b8-eaf9-4d96-a301-fbee7b662167", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424932, "uuid": "ce061e29-0df1-4080-941f-40b899f20857", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424932, "uuid": "e61aa7bd-cf8c-45eb-8cda-c764a521b3f4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424932, "uuid": "a9a14ba6-8b86-4e10-9ee9-7ee8c68ede6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424932, "uuid": "6876a171-cc52-4d5a-81e8-a7813b93feda", "value": "adf19cfbcfafc08e282180663e151b372beb363652a93433f11df9cde6d65e9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125625fc-9d6e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618438164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438164, "uuid": "8885403f-2f66-40dc-bc3d-49e414676352", "comment": "Malware payload", "value": "32c22734a2d3e6720995e40a68367f84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438164, "uuid": "000201ba-92ba-455c-85ab-52a83eff4842", "comment": "Malware payload", "value": "ae3dec23916f026d64c09fb20b7d77c9da20237de820f6d393984f46594a9e78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438164, "uuid": "e12d5071-d4fa-4613-a60d-93f2f7840d55", "comment": "Malware payload", "value": "deab0bab214c0a751771e690a35d6c6947de6866", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438164, "uuid": "3a82b9de-6f26-4c95-9146-7fc74bb90948", "comment": "Malware payload", "value": "e0d24acc10cb0cc603e7ce5a337f95dcda03cbf763a3725d5d89235f6d96d463abde76aa981a03597124d90058b4131a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438164, "uuid": "15794f1b-b73f-4362-a25e-44db0bfc01d4", "value": "D8536222B357CE62D49A56324EE1D2CB3274BDA3BD49530B308A734E2E77560C953F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438164, "uuid": "dadbe8f1-ec4b-4c29-961f-0e953eea0edc", "value": "192:oV58E1KJF/K3HY8Y9EoRA0yMfqmOx4C7AnrTs87+lAY6dZQ:pFCI8Y9EwAUfrOx57Avs8LY6dZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618438164, "uuid": "ad9d6aca-41dd-4da4-ad8e-fe45cc4fcfe2", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618438164, "uuid": "b60e1389-06d6-42be-8bd0-f3f35ce36ee0", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438164, "uuid": "f1d260fb-38c0-44b0-b09d-df54e95ab647", "value": "PO -28001 X67533AB.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71dd4303-9d7a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618443478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443478, "uuid": "93436d84-bec8-4e15-9807-9a5bd0976fe1", "comment": "Malware payload", "value": "571d705ea71c424d07734a6f29a4074a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443478, "uuid": "e7df700d-94cc-4825-b7be-10508a42b49b", "comment": "Malware payload", "value": "ae9c31b82ba271c8ccd1e0a6a26a2f0321355767ca64dd33d63153965f4e9b2d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443478, "uuid": "70d226d5-d50e-480a-85cf-87eb5cf57ef4", "comment": "Malware payload", "value": "173ce6beba26854637b22d3ed40a8d417c118011", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443478, "uuid": "1ab18e74-1e61-47fe-a741-c5c9fe960e38", "comment": "Malware payload", "value": "41ddbff1cd2a7d804e92ef46a039f9a4bb8f0dcd0bcb4af62cfdeea289fffd927c3eb1457355d9ff44a2f3146747f636", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443478, "uuid": "e0f5e946-7440-44a4-9840-52dd40e20bfa", "value": "F4F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443478, "uuid": "81331a33-7e1c-4144-9dc9-f8d67f35d0a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443478, "uuid": "bace1ac9-c47a-4d61-8d6a-bd768793b0b7", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618443478, "uuid": "9ac9cbb4-3183-47b0-8450-12c1a0602a20", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618443478, "uuid": "54ba2e69-c873-46d6-8ca3-3879273f1ff4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443478, "uuid": "a8760f23-7da0-470b-a9fa-38d5737cb9ce", "value": "ae9c31b82ba271c8ccd1e0a6a26a2f0321355767ca64dd33d63153965f4e9b2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b952014-9d54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618427227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427227, "uuid": "327b1219-828a-4e9e-97af-dc3fc4af87d1", "comment": "Malware payload", "value": "fc37a4cd10b09b4d2fbc1635822401e2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427227, "uuid": "2b4cff8a-e497-4305-b345-f930b858c117", "comment": "Malware payload", "value": "af85e97f23a6bf6429de9ca78cde8f90c8c557769abbec9fe86e4c59ecc86e04", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427227, "uuid": "7d8d3c98-d497-477c-b3e9-3317b2dc4991", "comment": "Malware payload", "value": "db5d454685e09e0e6a759c6c1990990ed4cac21e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427227, "uuid": "ef58cd75-72fd-41e4-b433-d2a8588746b0", "comment": "Malware payload", "value": "ef6bed669c0109a950f1e57892fb7af5f88a975cbdfa7db810a3c1dba8e1ddda53a18259aa3ca1de6bf703516c67e3b4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427227, "uuid": "f21f4441-810a-4d21-afe9-7c1ccce761c3", "value": "3EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427227, "uuid": "2fed76fc-ab52-4d75-a46d-5628d2e67d3c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427227, "uuid": "5cbfc4d9-bafa-4c11-bd19-35337196ac89", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618427227, "uuid": "572ca3b8-620a-4d47-8a3b-bccf632b757f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618427227, "uuid": "0203c5c8-e666-4239-a346-00a4995d9ddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427227, "uuid": "0cecc751-68c1-413d-8913-b8125f18a1a5", "value": "af85e97f23a6bf6429de9ca78cde8f90c8c557769abbec9fe86e4c59ecc86e04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b33a66a-9cef-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618383794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383794, "uuid": "9af81eb5-1469-473e-a66e-d90c06716827", "comment": "Malware payload (SnakeKeylogger)", "value": "759e03e482dbe6cf0cea88df754be69e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383794, "uuid": "72bf271c-27a8-4369-afbf-3e77fd79aae6", "comment": "Malware payload (SnakeKeylogger)", "value": "afce336270ec1334e311a332da375006bc9c05f5eac5b6f94a47fad21ec18ba2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383794, "uuid": "30c6ff3c-4c95-42af-a578-afbfc88c757e", "comment": "Malware payload (SnakeKeylogger)", "value": "dae0ec16992281a9a242ce0e925a26e50027094f", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618383794, "uuid": "924397ce-4d79-4c77-b0d3-67a15bba5ea1", "comment": "Malware payload (SnakeKeylogger)", "value": "77774464f627a67e637501a7c6e843a8129f6f28d3ed7eff0b4f1741e8afcf3c9d8abefc2ccf1cfe077ec004495026b3", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383794, "uuid": "b0a8d859-e225-4afd-a745-0f771d95cc47", "value": "FC45156D31049AD7C5AB03F6A32C4C0092F19D4EAAFBF64DE8833C96B6BD741B521547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383794, "uuid": "232ad30c-3e80-4462-950e-b6584be021b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383794, "uuid": "728c48f9-7663-40c4-84f2-3e3928ce1724", "value": "12288:xbPY4NzzzD/1AnvE1pb9vA5sI4M6YnKhdh6a7omgSZmgj:xjY4B/wvabxA5sIx6YKPlAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618383794, "uuid": "a992cf15-26d1-49ad-9972-0671d984c264", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618383794, "uuid": "b4f1a13f-a1a0-4e91-b768-b76d32a98335", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618383794, "uuid": "e6732bbf-140b-4f28-8c1b-eacd439b6095", "value": "Commercial Imports Inquiry - Import.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befc4f93-9cf1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618384767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384767, "uuid": "a7ce2c53-cbe2-43e1-b8b1-f9c4ac881e3c", "comment": "Malware payload", "value": "eac4456d96bdef96016747e66a7ab97a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384767, "uuid": "cb69bd55-fcc1-4b29-bb87-09658781c782", "comment": "Malware payload", "value": "b0e71b1dee18e0fb08f5fe7d6de31a23c2dfc41ad26698634a82b15d2da75b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384767, "uuid": "a51a9e91-281b-46ae-994f-93e7990eaf46", "comment": "Malware payload", "value": "6fafd10a586c7c152345e5ea80b9fc0660f6478d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384767, "uuid": "4b2f8089-9de4-47e4-8920-6c66f0acd829", "comment": "Malware payload", "value": "68dfba1da497ac1c71973340477d89de8d97843340a93ee1d248de933c75c0fdc2888848466163b2a20b80c1ed52c863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384767, "uuid": "a74f3ac9-b1d2-4716-96b6-a35bd74045d9", "value": "30C67B40B7808127D8E501B491F5566B9E34ED73230227D376ACB0BD6BB92E5EA3D3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384767, "uuid": "a72b0453-4814-4fd8-9198-48aaf7f821f8", "value": "b28c641d753fb51b62a00fe6115070ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384767, "uuid": "176a96aa-e119-4184-8313-842b69002961", "value": "98304:5WL6UPI4CMbxdeZAhXhMnHXledIpm8K2tpUxLOKmeqv0D8xdIGZKAEzpB3rLsPm2:5W5PhdAAZiVqxJLWe20OIzpIUMSSr+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618384767, "uuid": "92ea3591-2911-44cd-95aa-078f261017cf", "value": 11506569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618384767, "uuid": "0a208e13-38ea-4601-8521-7c917678b109", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384767, "uuid": "637bf310-bbc5-44d7-8fa5-e24293de74a8", "value": "gg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38870e5-9cc1-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1618364185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618364185, "uuid": "b6b1cd25-b0a9-415e-a9db-ecda10bac4b5", "comment": "Malware payload (FormBook)", "value": "5ec1bef3902927425ea410241694573d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618364185, "uuid": "5918afe9-0088-4c82-b21a-291ee3e06574", "comment": "Malware payload (FormBook)", "value": "b14215dab8e66a85c4d94fb12ca0fdd144d21df31c15876df664383655821545", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618364185, "uuid": "87e20006-1eee-484d-ac59-7617e6cfc229", "comment": "Malware payload (FormBook)", "value": "af9c153a91464a6ce1e9cee8a509e9289e0b80e6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618364185, "uuid": "ab732834-0423-4635-b8fb-ad5b1f474332", "comment": "Malware payload (FormBook)", "value": "b32d56e0384d80baef29e44f468fe211fd357fb8b47084fb89a038d8204ea19d553f8eead09ba2563f0015f4108e90e1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618364185, "uuid": "2f942c0b-3bd2-4641-9b7e-4dc71733837c", "value": "BBE522E6D330606FCDE8573E85E8E81C9084AE1E7E71E08E15B0BB4B77F26960895F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618364185, "uuid": "fcf91d25-092a-4049-9ebb-9103d8ffe35a", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618364185, "uuid": "8567c4a7-12a7-4993-959d-a045dba6d4bf", "value": "98304:nlt9B/ysk5AviLvpELwXdycghjLNUt/tooIdnWlN:HsAviTpTd1Ojytqoaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618364185, "uuid": "b3ab0478-eb37-4251-82cd-d9d5cc9d008b", "value": 3171396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618364185, "uuid": "afb35193-4c32-41ab-828b-6779b0dff540", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618364185, "uuid": "587bb42f-65a3-486b-ba8f-bd90ab2e3334", "value": "T_Slip_May09019203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272c8cd6-9ced-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618382794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382794, "uuid": "15a34bef-8a1b-4ebf-b9d1-7cca6688f586", "comment": "Malware payload (AgentTesla)", "value": "18c468ef47c089bce28f8cd7cc150be9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382794, "uuid": "be991223-d109-4aa8-8728-0285bbb011ea", "comment": "Malware payload (AgentTesla)", "value": "b26edbc7531ad737e74892f0f2187a3e320b9e00b25c231f818403f156a7b4bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382794, "uuid": "060e7462-8db3-42fa-9a82-513841a0eb91", "comment": "Malware payload (AgentTesla)", "value": "2800440743b3924ead8e9c05cb0506bc4d40681d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382794, "uuid": "498e4ea6-5855-4f42-b85d-87318500ed09", "comment": "Malware payload (AgentTesla)", "value": "1b8841475d7e9d4f43e7769eacf7b3beb28204e82c8821545b052da4679a63ac22ef52c97bb73ec9fa9333244254e5ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382794, "uuid": "71ee4ff0-a88c-448e-a483-b733a161a062", "value": "02C533A9F9E19F06F25D94BC898EAE39813D1C408A14D84BB70C7611563B9F437EA73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382794, "uuid": "0a0b45e6-7031-405f-a24b-00c949b20c77", "value": "49152:d0wiHz584I6fGFvM4bM2CLndIL40rpBiigZYDsqL7fC/U5o:dIV8E++8mdIM0r+ZTqWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618382794, "uuid": "a749ea25-59ff-441e-b520-eef7de3e736f", "value": 2613760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618382794, "uuid": "2769a3d6-67a8-4541-a133-da9294642c1e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382794, "uuid": "e0e6f3b3-c01e-4290-b90c-0dcf6bbc534c", "value": "Commercial and Technical Proposal for%0D%0A Supply.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdb2958-9cf1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618384795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384795, "uuid": "9180c717-bc98-450c-bbd0-470bba41f118", "comment": "Malware payload", "value": "1e5112d7f0b60acd75401fae6c0aa853", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384795, "uuid": "82a0819f-764d-4f67-b00c-e5a33a12d19c", "comment": "Malware payload", "value": "b2ce265798a6da3d44e7da2266960ac00e31c00a2df954793678445e8f70f747", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384795, "uuid": "b318c48e-5c02-41ba-8efd-11697f1d2289", "comment": "Malware payload", "value": "b2582c7c2e3e7dcc725d6142b3342f8e47a3f23d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384795, "uuid": "2d09f0d8-c1fa-4403-b28f-91d03db3ca81", "comment": "Malware payload", "value": "80b56eeb9c35c12a8bb6f40f1b724108f8a69b5347cc5d1dcdfcb309ffaf6c79155fdf8db7282176f46a5636527f81d6", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384795, "uuid": "bda16a77-5b9c-4395-bf56-9dcf896e871d", "value": "A8C5332D32D0BF17C2BF98F42F5935B9EA718C592A9AED553B487A1DB13303179C2284", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384795, "uuid": "37ab166c-b121-49b4-8260-30b6c13aa58e", "value": "49152:B2oZrp2V0AE3doZGnCdPQNhtTmiK2P4PgQjXCctjJ5k2FJr1oVyepv9:B26bwPQNo2P4PgmXphk2/xixp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618384795, "uuid": "7d079275-613b-499c-a6f5-e436dbfbd302", "value": 2503168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618384795, "uuid": "3c3b6e9b-682e-46f2-97ae-0ba76a0d5f81", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384795, "uuid": "8db41fc1-938e-4db5-bc4a-a95d1053cfe8", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d13a86b-9d00-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618390991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390991, "uuid": "8e36e319-65fa-4f54-a768-3008b4deb476", "comment": "Malware payload", "value": "b8d8d70d8f61335f0bbfd01eeacf51a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390991, "uuid": "866d820c-a60b-4601-9e62-f606265b8864", "comment": "Malware payload", "value": "b3184460e58c2e3a063056eb8bb4e14eba4bfd65689c7f820d2fed04fad5700f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390991, "uuid": "6e29f165-2d20-40c6-be6b-f2e8ba7a27f1", "comment": "Malware payload", "value": "6b46f8eb374525bd1b5670f5ca9cd603c124d9b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390991, "uuid": "8826afb5-46e0-48d0-b3fa-29f7945693fa", "comment": "Malware payload", "value": "17e9f1dd962fa59e651ecbcae6172a919ce5244d8ccb0b3de141daa41c0bc2ae0e2a9a6a266027aa34a60625adc46b0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390991, "uuid": "58c5e772-1dd6-44c3-a2e6-bb3e04c76ee8", "value": "D2D423855A62576CCFEE6DF02F30C35D912D98DB8BCDD885208D16F4DE065329D28AE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390991, "uuid": "1d60a0ed-c5d5-4bcc-ac74-356690ad0f57", "value": "12288:zB8magKNCVdsYm+L1TkVjdtMkEyetAFSMbmZnnJAdB6sI/ZcI:zyn0aYm+YjPM5yetwSMbsnU6lN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618390991, "uuid": "a66611c8-5b79-4b46-bca1-e169f8ee7a57", "value": 607019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618390991, "uuid": "0f35aeee-768d-41b5-b5c5-a2e227155650", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390991, "uuid": "aeb14340-008b-4e8d-90b8-347dc0aac8f3", "value": "RQ948594.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17879137-9d6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618438602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438602, "uuid": "b39f657a-25a9-4494-99c1-c9c43d8e035d", "comment": "Malware payload", "value": "118e00d7dcfa799ec602b913a48ddf18", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438602, "uuid": "bd1ba7d5-e55c-4b47-b813-1c14a008b3eb", "comment": "Malware payload", "value": "b3aeb43232f12134d54388120b30a4595a53e93c960803942a5f5f74e57384b9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438602, "uuid": "2393e303-f433-4bcf-b645-3003460d3d7d", "comment": "Malware payload", "value": "65aec6bed8e16bc2bcb254c7b2ba26084577d278", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438602, "uuid": "5729e8c0-338e-47a9-8009-6b9783918712", "comment": "Malware payload", "value": "57cef65d7e8d863557b6dd53a0b5b08287135f0656f73c4af06776b98a7bb376f899797cb97c2c35ae31d1d20d33f3d6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438602, "uuid": "914c1f0f-9d51-4549-a87f-7c16d7b40139", "value": "A8249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438602, "uuid": "40c32810-d554-469f-b173-41529ccfa1e0", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438602, "uuid": "c2a79161-02a7-432b-95e8-8d3584b8d02f", "value": "3072:I0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:DpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618438602, "uuid": "28e1321b-3742-491d-a07a-34450422d06c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618438602, "uuid": "9168ba62-33dc-468d-8dc7-0ca37f822c40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438602, "uuid": "f62571c0-d2c0-403e-8226-ec9ca41ac16c", "value": "b3aeb43232f12134d54388120b30a4595a53e93c960803942a5f5f74e57384b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963aab98-9d6d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618437956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437956, "uuid": "62b7d0a6-f690-49bd-968e-ccbf663a03cb", "comment": "Malware payload", "value": "89481903633b13db9a5d0b754c5d66d1", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437956, "uuid": "7baa3e9c-9a97-4a8e-ac01-90d0d479fc23", "comment": "Malware payload", "value": "b3d0bb0f929537495c21cdfc76513e82d148d2c759c1556cf0e16ef3049e6b45", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437956, "uuid": "63f30a09-4f22-466d-9592-7c454e40e9dd", "comment": "Malware payload", "value": "7fae020518c96663069d68172017b24325602e6c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437956, "uuid": "bf4d31d7-9c97-4f3f-a367-29c5cc28dece", "comment": "Malware payload", "value": "ee97de78a5d1c413c5b20d6a536af43e0905309c96a583f389ed9d768eef86d78e5220db13a57bdb30cf62e47dd788a5", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437956, "uuid": "b020dcbe-6f82-4a17-bc01-f78629ab2b79", "value": "94F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437956, "uuid": "073da02e-8275-48d3-a68d-a20413a60ea5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437956, "uuid": "893c3e88-13ae-4018-ac59-7c9961377416", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618437956, "uuid": "fb2ed657-290b-4100-b851-c0fa704a2a0f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618437956, "uuid": "d08651d7-21fc-4751-8535-fd9b004cbe94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437956, "uuid": "18c75f6a-bb08-4436-8d68-574f5551dd42", "value": "b3d0bb0f929537495c21cdfc76513e82d148d2c759c1556cf0e16ef3049e6b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6983eb0-9d3f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418334, "uuid": "dbc717aa-17a4-4d89-a014-985d52583480", "comment": "Malware payload", "value": "f9cdbe043c321509b1456313c33566c7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418334, "uuid": "daaa45f2-0c74-4d5f-bb9b-5f20cc09b081", "comment": "Malware payload", "value": "b4275785ae49175d20cf07609b4d34f8e10ae3669772d7d42acbada6e59e3d6e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418334, "uuid": "0b2eda7b-6fef-4e5b-bd71-a242d65b4299", "comment": "Malware payload", "value": "f3b3a1ff987c5215071d4028cd19faf91e2cd470", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418334, "uuid": "ac7f2f23-b4a0-4110-988e-a6a29bbd915e", "comment": "Malware payload", "value": "263b07160668a6124cdaffdd4e37c322a281a3d4e679c49ec1af6880e34d6d3394a65233d4a939698c14a27d277c9fff", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418334, "uuid": "e494e0ec-9ac8-4b8f-9845-99f94cb95af1", "value": "EF249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418334, "uuid": "e954b86d-f602-4b68-b5cd-124fec90abd5", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418334, "uuid": "5b1969ac-5bd3-4dc5-9db5-1c781a4646cf", "value": "3072:c0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:npepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418334, "uuid": "3932e4dd-134c-4eaa-aecc-0af361d672d4", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418334, "uuid": "cd3f8e61-ab63-4a6c-b035-b7cfc9f1adce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418334, "uuid": "a071ef44-799a-4c8a-a23b-72de3fd7de5f", "value": "b4275785ae49175d20cf07609b4d34f8e10ae3669772d7d42acbada6e59e3d6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dba512-9d41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419035, "uuid": "fe0ab532-16b8-4849-816b-ad0362a7f9e7", "comment": "Malware payload", "value": "1b1d7aab45c38c6bfbfd91f1bcda4340", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419035, "uuid": "f97a5d48-6d72-4517-b490-1fac0d66ccdf", "comment": "Malware payload", "value": "b59a26e3d719f84482591994cea728c7976741fb4045d68e3c29988ff43207db", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419035, "uuid": "24488597-673d-4ac6-97a7-c5c3081ce9c7", "comment": "Malware payload", "value": "c98f51569cc2610d93ae1386777024af84a562b0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419035, "uuid": "7a785938-0ab1-4ee5-9c79-c79a39369fb3", "comment": "Malware payload", "value": "f63bc0b82992ae8f2c9da268a8bb03c6f9b7636c8e652881cc99225f9c44cc5a746ae9c76bb9126d0d7a0e74476aacaf", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419035, "uuid": "21ae9672-ae4d-43a5-bca0-06fd9df935ac", "value": "57249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419035, "uuid": "321f0d4f-a399-4a5d-ab49-389b48defaeb", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419035, "uuid": "cf80b184-5ce2-44f6-a5db-049f3bd71c86", "value": "3072:l0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:opepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419035, "uuid": "f36a114f-1c7d-4e8f-ab8b-569f4bc1b202", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419035, "uuid": "254ca2b5-d6df-4faf-b543-bf7eec70b372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419035, "uuid": "e07064e7-9c7e-4b90-aa73-8a0c0844f2e6", "value": "b59a26e3d719f84482591994cea728c7976741fb4045d68e3c29988ff43207db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1da421-9d25-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618407017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407017, "uuid": "1dafd809-a7b9-4393-87fb-41086ddc9272", "comment": "Malware payload", "value": "35653582d3684ef388121dca3c76e4f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407017, "uuid": "98690b5e-68bf-4204-a022-c93ff508e805", "comment": "Malware payload", "value": "b5d8a24e97905a0333243481930777008b654c43dd04bbf995d75334183c8070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407017, "uuid": "f2ca636f-5a32-457c-ab53-c7595b540870", "comment": "Malware payload", "value": "cad076564cbd9ce8c30b8dc0f3ff4797c7176bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407017, "uuid": "37ea1c3f-106b-4f8b-9148-315973ea56b9", "comment": "Malware payload", "value": "e8ac5ea66e324c060402d460cbda1e19b3a551afc8d79afc1de0bdd163d522e50599d39133c89d40253874353cd2e982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407017, "uuid": "630fbe10-d2fb-4264-ad0a-951961b4c4cb", "value": "4A65022223F88B25F2BF7B756432125407F1F886DB35E20D3EA540DD0A79F6189667A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407017, "uuid": "df45de05-84bd-419e-adb7-aa07ff576aed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407017, "uuid": "39c737a4-1d04-4c5d-bdd0-e976a48c7cd0", "value": "24576:1QkPXrGQtxtO919PJW99C8IzaJIMIv605nOFu6AxrMXMNJ7bW:pPXJfYXhW99eHtTxO6Mgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618407017, "uuid": "cdec12e4-6424-448f-acc1-d78d0df6494d", "value": 1434624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618407017, "uuid": "9f8c519e-8f13-47d0-aced-837efd33e383", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407017, "uuid": "9c71041f-9037-47b8-942d-5f2c3fabf866", "value": "bank payment confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b8b87e-9d62-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432982, "uuid": "26a0b009-6fb4-40fd-a262-67308a0d65fc", "comment": "Malware payload", "value": "60351ff710c7a2f79b8c913babf4d051", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432982, "uuid": "74c1d141-ab21-4bb3-bbca-7c17130d8cb4", "comment": "Malware payload", "value": "b6c8cbe166c144433383db798d31f86c95389eed3347c65c8f679b8df29d3b65", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432982, "uuid": "4317b3c5-c94a-4dbd-afbe-9b1acedc598f", "comment": "Malware payload", "value": "80c0d86b5442bb247b85d173b37fa4559b31d350", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432982, "uuid": "36215a46-2a89-4461-bc6f-40607d54d903", "comment": "Malware payload", "value": "692ff449a4b5b7084efb9d43b97497f0d654c3d609297d9767a53aa7301ab27ee9b66d2e7f688c6c573710a934411899", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432982, "uuid": "0143203a-4bca-48db-bf36-7e6cd482ce94", "value": "D9249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432982, "uuid": "af21f40e-1986-4a8e-846a-6a24f74d949c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432982, "uuid": "0d8f1ace-00d3-49d4-a461-d5296bb48adf", "value": "3072:T0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:SpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432982, "uuid": "978e35b7-8dbd-4cf8-a2f8-197c686fefe7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432982, "uuid": "ddc3d823-507c-4557-88a9-74809383d3de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432982, "uuid": "3992f8fb-7545-4422-b030-611d5177d5df", "value": "b6c8cbe166c144433383db798d31f86c95389eed3347c65c8f679b8df29d3b65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cae494-9d73-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618440420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440420, "uuid": "7cc4590c-455e-47d2-aa84-d26307f6ef46", "comment": "Malware payload", "value": "884bc3566abbe57505d51f80e0753d74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440420, "uuid": "cf8ba532-6da9-4b5d-8375-75af76183f10", "comment": "Malware payload", "value": "b859380da04cfc0731072c4286b4af451c443d3c376b5f2660b108917680d5e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440420, "uuid": "03172dc1-0a77-43e7-91a0-ed6187d2ef56", "comment": "Malware payload", "value": "88e6c12df19173cfaa919a22d859e091050f09e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440420, "uuid": "eec8b586-222a-4fe2-a53f-8872f8dae2b6", "comment": "Malware payload", "value": "8e2c619048d70ee3f781f00537fad4f561412d13b2a9853c037bdfc753dfe57ef5ce2a095474802ab07c59f2a6588a5c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440420, "uuid": "ad63b4dc-54fc-492d-ac0c-5b7fa99b163f", "value": "2274124FEFF7DD8BDD6605F7EC0211D465EAF0A9A90A937E87C8401990B1AB491C2633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440420, "uuid": "be211456-55c2-4a74-8a9a-66fa2b51acca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440420, "uuid": "b6c24c51-d013-4398-806f-52c28d220f5b", "value": "6144:WDE9WB1zHrBJCRc4Q7fcT2kE/W0VGGIR4Z3/9iYG5DnvAOSOU4QXwd:N+1zHFHlYb0tIE3ViPk4kAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618440420, "uuid": "034f7483-03aa-42d0-b5dd-2d2e8f2c364b", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618440420, "uuid": "26c32b4c-d7c3-484f-bb18-5fd7016cd750", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440420, "uuid": "8c01c751-a08e-444e-8b69-3cf62e45d5d1", "value": "SecuriteInfo.com.Trojan.Packed2.41837.12962.25696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5034248-9d60-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432531, "uuid": "7c5d5f70-4090-417a-9ee3-c746330812eb", "comment": "Malware payload", "value": "d274ce05b3aac1505c1b169489ca23f6", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432531, "uuid": "4e8360c8-66e2-40ba-b9c1-ea7fc50a26a2", "comment": "Malware payload", "value": "b8a7b8dcdb6c5e1685b1c2e7259b1efba907544326994c95fe8997604fef692b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432531, "uuid": "9a69ad1a-2aeb-4d03-9cc2-7bd1c2c57e18", "comment": "Malware payload", "value": "e8db34bee2a0c726d6e6d57d7a89000638504db1", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432531, "uuid": "d9f37657-1442-4c58-8373-3c8aab21c4ed", "comment": "Malware payload", "value": "62b99c738f9a12914fc9cd0c1b09774257094af90c155c68ec3cb614e921d60a29fd2557dd64b136b510e37b7886fa24", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432531, "uuid": "1e0b2aec-ccac-4df9-bd46-af6c596d122c", "value": "AC249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432531, "uuid": "2e751b64-bd6a-49f0-9a01-d4792a5bc88d", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432531, "uuid": "1afe1c0f-5717-4ea2-8aa9-c551d4170c38", "value": "3072:t0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:wpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432531, "uuid": "713e371c-dd8c-4560-9e00-0f03a0329660", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432531, "uuid": "2a091158-e40f-427c-a884-35e9a0dcf19b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432531, "uuid": "0dd8e160-08dc-4f1d-834a-159bccd15e4d", "value": "b8a7b8dcdb6c5e1685b1c2e7259b1efba907544326994c95fe8997604fef692b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6963398a-9d7a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618443464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443464, "uuid": "7a44152d-74ca-4dba-8b35-132088c7ea17", "comment": "Malware payload", "value": "58fc2edb20663766fe8546f2b7d8b96b", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443464, "uuid": "d508f835-836c-45f1-8b4a-8e217498cf41", "comment": "Malware payload", "value": "bb2ea5539b175b0efe9279356f29d9aab6c82175a03a705eb928fe3dcba4674a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443464, "uuid": "07b515ba-f083-429b-915c-bac2fac2aaa3", "comment": "Malware payload", "value": "e76c03129732d0ce1a28868d102a4ff82dd2d213", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443464, "uuid": "c065a9a0-274f-49f2-8691-8052c855ed97", "comment": "Malware payload", "value": "02b0056d56cd0106943a432c9789bfa9a999f1cad702377d54b9b02ead0de323ae7fd4716ce29ca3b58246134be4ab19", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443464, "uuid": "4138ab2a-914f-4797-a2a8-47887e93b865", "value": "EB249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443464, "uuid": "d62b3b24-32af-420f-80d4-18a58227699d", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443464, "uuid": "1bddbe9c-69bb-4094-815c-d8662dd3136e", "value": "3072:Z0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:spepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618443464, "uuid": "629cf0b4-a15e-462d-857c-4daa29dd0ee0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618443464, "uuid": "d0c13292-2bdc-4e15-a7e5-89a723e43fb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443464, "uuid": "3e6e0b67-da9c-4954-ad5d-28f7a595346c", "value": "bb2ea5539b175b0efe9279356f29d9aab6c82175a03a705eb928fe3dcba4674a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42b34d1-9cf9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618388184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618388184, "uuid": "daca8795-1d01-4dff-9fa7-b26598cdfa77", "comment": "Malware payload", "value": "bcd35bd134ca2633f9e7c4c9d16b80df", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618388184, "uuid": "85c3d7da-81bf-4922-928f-e2da0151d036", "comment": "Malware payload", "value": "bbb7a2aaf49267d64ff616fbd995475dbd7f2cf300b769e083a302e7185f9039", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618388184, "uuid": "58c81b84-8359-4445-b51b-8c7e44968057", "comment": "Malware payload", "value": "a197d0c06fb05c8026e89690cb9ec2b1692d2830", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618388184, "uuid": "8fb0c9cc-3e15-4ca7-b703-b8f312e2e0eb", "comment": "Malware payload", "value": "258873d60fd5594884f1302f6ea0656865c4d42a7b47328bd65f21cd7cd3f250331213e5ad25f844eee4cc7a885d30ae", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618388184, "uuid": "567fa6fd-dc38-46fd-a7eb-ffc1229d4443", "value": "6BA401E1E1D2AF56CA87933C8CA9F346E9CD8D75C28CD14A4A45B2DD8BF4E533132492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618388184, "uuid": "043505b1-d2a9-49de-ab6a-a010f9113aae", "value": "12288:onPsn1xbIppL8KTCSYu7Ih8PO7xFPjKFzx4XE5a:g0nbfKTCw7IyW7HQ205a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618388184, "uuid": "90fd6322-1e36-4504-8133-4229528efdce", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618388184, "uuid": "c4563002-45d9-47eb-9c6c-eb40a763d36a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618388184, "uuid": "7593d2ef-1856-4450-a11e-120a5f5e0983", "value": "OMSMarineServices order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727689ba-9d43-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419857, "uuid": "99625fc9-b99f-4cef-a428-17b4021f71eb", "comment": "Malware payload", "value": "1f4a166df6a20b8afdd09b56b31177bb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419857, "uuid": "a5498979-79ec-4544-ab5f-b18966657b07", "comment": "Malware payload", "value": "bbdfacff9cafa740bb4019075f87e4efc7d79d1f9facf958f1b81990def29cff", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419857, "uuid": "2619d1ca-3477-4c8e-869f-5e7b351ef73f", "comment": "Malware payload", "value": "47d7451f03c327d088b90fa9b4dcdf2bb163f8a7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419857, "uuid": "71e06f2f-fa77-485a-88cf-b99c9ad11461", "comment": "Malware payload", "value": "62c9f8b9e086c1af03d7c19a0d117fcaf9838d42d9d03a4f409a8ee154ee3183b2af5702454810e47cf7342cc9b05958", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419857, "uuid": "6f3caee4-0cfd-401a-a9c2-3fb6f7a36aa5", "value": "27F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419857, "uuid": "514938b5-a8cb-4a3c-8be1-748a8637c659", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419857, "uuid": "9315241a-9407-482d-acb0-7c353a381af5", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419857, "uuid": "91c62a76-983d-4c46-aa52-dea4c089d17b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419857, "uuid": "1c348213-ce0e-4222-b86f-b9fa49023e81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419857, "uuid": "05f1f755-1dfe-4788-8d91-a18fabc52484", "value": "bbdfacff9cafa740bb4019075f87e4efc7d79d1f9facf958f1b81990def29cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc5aaa7-9d31-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618412229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618412229, "uuid": "31148b4e-9b6c-41a5-99c4-6c85c801d2dd", "comment": "Malware payload", "value": "30817eac74991bb376a30d3d6d464e60", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618412229, "uuid": "765d982c-1c3e-4425-80c1-dda3f915527f", "comment": "Malware payload", "value": "bc2adc33f027ec3b8090b6ae270732f23cb15dffe41ed44b77022fe73ee179ff", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618412229, "uuid": "233148fe-9481-42f7-bea3-9b12f5b57b38", "comment": "Malware payload", "value": "4fd04e99fb315d201d2ac309e86b92eb1f23469f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618412229, "uuid": "ebbd1c12-f27e-4340-8965-c0ee81ac29f5", "comment": "Malware payload", "value": "e8431ef852055831b66b44aa9f601a6db033fae80679a0c058515a9f969fd9dc718c5eea1f668b0ae2c93b39dc939d11", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618412229, "uuid": "04d5e491-a1c2-4c93-80ed-65eae12d63e1", "value": "77B41227B603E421C89F4E34372521C7663E2723F871F49B25797DE0939EB2958346AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618412229, "uuid": "a6f2b53d-c135-4088-9dc6-13f20dd7abe9", "value": "12288:aToTdwOewyOGGGvfG0GGG7jpP7OGGGTU5dUGo/HhfC1Zbw8BRU1vyAz+sZT7k06z:aqewyOGGGnG0GGG7jpP7OGGGTU5dUGSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618412229, "uuid": "95cffea8-a78e-4462-93b0-6ce6968ddad1", "value": 497134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618412229, "uuid": "59d4d15f-a852-4d7f-9053-7b919062573d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618412229, "uuid": "592bd606-d388-41cc-8bac-85cbebeb65c2", "value": "Inquiry_For_Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421a2d4d-9d4e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424500, "uuid": "7c2a595f-ae17-446f-b0b5-b8ed9f66310d", "comment": "Malware payload", "value": "0752f2feabf8714126f7e65534b25250", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424500, "uuid": "036947cf-22c2-44f8-aa90-bc131966bd4d", "comment": "Malware payload", "value": "bc99fe5adb9c306081081d05acb4deca2cd230396cd05a83fe5d7c6403fcdff8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424500, "uuid": "139acf1f-cf68-4729-abf6-732f9f0f92c5", "comment": "Malware payload", "value": "b6370900e9e88e81978a92f237dd20fcf4ebb36b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424500, "uuid": "0d0097d2-3295-4d20-975d-bb82a516aa0f", "comment": "Malware payload", "value": "23f605a33cf61a11c541a9be1b36f94ab2688ee444f4eff4a5816de03b276c27a83c774230ae90eb463d8ffac094ef91", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424500, "uuid": "538bdd97-5ffd-4574-b52a-0b4b7847efff", "value": "64F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424500, "uuid": "5eac8ec1-f0df-4eee-ac60-9c2c8048b402", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424500, "uuid": "4243bf9b-b0e4-4ae8-822f-ebc3fe534dc6", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424500, "uuid": "34140376-a8ba-467f-af1e-dece7339ad27", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424500, "uuid": "115fa3b5-f591-49d7-9fc9-61058e3e6d19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424500, "uuid": "7467737f-d657-46b9-b1f1-e02eef1b00f7", "value": "bc99fe5adb9c306081081d05acb4deca2cd230396cd05a83fe5d7c6403fcdff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245cc5eb-9d52-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426168, "uuid": "9de7ad73-581e-4733-bdfa-c87cc8edacbf", "comment": "Malware payload", "value": "ab75cd3662d56cb648d2dd32cf632bac", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426168, "uuid": "a24f5d74-444a-4731-a511-221188021712", "comment": "Malware payload", "value": "be44a9a4a05d0e2634351fb6a4feb7483468e66f6415982c8161c41555cbc46e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426168, "uuid": "9520ec1a-236d-4871-8409-cb662b635b3e", "comment": "Malware payload", "value": "c8a39899a10102f91c760665b60b847491565af9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426168, "uuid": "04290292-b23c-4fbd-b6b1-967e4469dad5", "comment": "Malware payload", "value": "b17ecb79a1fc990cd592b96fb13e5f65fb31c5d8a72da77d1f4a27b81ce3f1d01cdd1296214d1cf22e08a5767e344582", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426168, "uuid": "3bbaf6e6-e8bc-4ac3-b1bf-95f24c9c19a6", "value": "54F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426168, "uuid": "0a70da6e-ef72-429b-8ebe-47ab901f43d2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426168, "uuid": "55f38151-4d6b-4ed6-9c82-fd1b523698c2", "value": "3072:blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426168, "uuid": "1011a9f1-36c0-46c7-9ad0-23504051e636", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426168, "uuid": "c9430d84-0541-46d7-b53f-168852223ee7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426168, "uuid": "aa1a2994-360b-4f2b-a014-85eadb556eaa", "value": "be44a9a4a05d0e2634351fb6a4feb7483468e66f6415982c8161c41555cbc46e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd91aca-9d45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420599, "uuid": "75416890-bb4f-4ec1-aefb-e7a65805c990", "comment": "Malware payload", "value": "dd2df1da61adacd74f6f6945cd4afaac", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420599, "uuid": "a3e31087-1e65-48c7-b3bc-96afc9fbf77a", "comment": "Malware payload", "value": "beba3c48adec62308e6dd939528a6cfade7df5e46b8f47a1e3050e3a458d0c44", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420599, "uuid": "f2e74dd5-500b-4fbd-8a3c-61ed25b88b05", "comment": "Malware payload", "value": "3c1c693644ff0e98ca7c67ae66fd6d8660e0db8a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420599, "uuid": "557a85e8-aaef-463c-8d56-a002512ac3ba", "comment": "Malware payload", "value": "0d183c6cfe4fdd74ffa6f1c4375447e1e7077fc55c8123a64ed72b95d46d15fde8d802aca75ddea41f93fbaa9212f991", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420599, "uuid": "cfc3ffd1-4193-4571-a5a9-dc259ca2b8ba", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420599, "uuid": "03f57e41-e889-422e-af84-45904516ca94", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420599, "uuid": "ab2c17ef-c418-465d-903a-dc0b6a111c11", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420599, "uuid": "a7888ef1-c119-488f-a3d2-b41a1dc87738", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420599, "uuid": "9ea43070-4f33-43be-a744-db7996d4c249", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420599, "uuid": "f700249b-ebcc-41d5-9c53-681d235b9561", "value": "beba3c48adec62308e6dd939528a6cfade7df5e46b8f47a1e3050e3a458d0c44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6b335a-9d6c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618437480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437480, "uuid": "db56df8f-d708-43da-bcdc-d55927d2da59", "comment": "Malware payload", "value": "d8a4415cad66ba94de79d59546978369", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437480, "uuid": "2770e4f1-b4d6-41a8-a5a8-d7a6314cb64a", "comment": "Malware payload", "value": "c14a6030168b48e28fc1a4a767e8bbb3d035961700f2a9dad29d605b25a04974", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437480, "uuid": "af20c7b7-ea78-4790-9aa7-dad72b4e841c", "comment": "Malware payload", "value": "d18700d66d34776c35595e8822ecd66782a25599", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618437480, "uuid": "f61589a3-27aa-43e7-bb73-f8a72b659cb0", "comment": "Malware payload", "value": "57c837556b609cdc123c84c80b7530c7b3cc0d72102dcf8d5358f3f711390e03ae6f358cafbeb4c99bfbffb3ca36d0cd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437480, "uuid": "d2eedf17-13c1-4df8-bd37-8b4d9d619959", "value": "D2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437480, "uuid": "ebbb7104-3fac-43e1-b729-a4138a36d822", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437480, "uuid": "afd26bfd-80a6-4477-8bca-0fb7ad3b31a2", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618437480, "uuid": "800a9d0f-938f-4aa5-ba0c-cfc2507c4dde", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618437480, "uuid": "7b1a843c-efa5-4e36-b1a2-cd5afbe1d5a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618437480, "uuid": "590494af-09ff-4764-89bf-5eb41d6bca88", "value": "c14a6030168b48e28fc1a4a767e8bbb3d035961700f2a9dad29d605b25a04974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c0ed17-9d3b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618416297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416297, "uuid": "6e14a993-cf9c-408e-a0a6-29b739e10b44", "comment": "Malware payload", "value": "b5b3c450d7036e91e263a5ad330342d3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416297, "uuid": "c5e85eb8-f5e4-4139-8f4a-fabdfa21f8e6", "comment": "Malware payload", "value": "c1a6e6c2512e882eb446f8f29273b75ca1466e57d084a61f0c91a8c88ce0e071", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416297, "uuid": "f7e78e3a-7df7-4289-838b-d5c3a6ef17ee", "comment": "Malware payload", "value": "edf7264bbc2bd53a3bc56ccfccf97c1388d10dbe", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416297, "uuid": "801eed70-7e66-4d28-9035-4df9dae14522", "comment": "Malware payload", "value": "8467e6f0db5bf624387678403faa0ecff2c6bb3d52be3ff21bdd6cdec9ea858eebf6f7899bfc7d7bf37b87897e5e31be", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416297, "uuid": "60b83542-b657-46da-8e75-1e920987d500", "value": "20249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416297, "uuid": "5b79af10-b4e3-4128-ad42-8cf5b2921a13", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416297, "uuid": "428fa017-62cd-4882-a93f-3a0bf14e9f86", "value": "3072:j0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:CpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618416297, "uuid": "3383f245-0965-423e-9a20-f1a406671ef1", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618416297, "uuid": "cff54cca-ccdb-4c8e-8c8c-228bfe6e9f7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416297, "uuid": "bbf5713a-905b-4d88-a529-4249bca0ac3a", "value": "c1a6e6c2512e882eb446f8f29273b75ca1466e57d084a61f0c91a8c88ce0e071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a14591d-9d79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618443009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443009, "uuid": "a901ea86-49d3-437d-907c-c0d3a29953d7", "comment": "Malware payload", "value": "7d1c0f48fad28ee9e3769f6c7633b279", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443009, "uuid": "51e74020-290f-41a6-9f97-fd2dc64adc3d", "comment": "Malware payload", "value": "c32ef1fb195973b28c4e3edf5ede34b36ef6aa8c24db57f1bbba54ef3d1505d4", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443009, "uuid": "ed3ad9a0-f6d7-43b5-a669-d375135e9bb2", "comment": "Malware payload", "value": "7029a5d2819d81f7686818ea9b7a13cc63e7f150", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443009, "uuid": "51020dad-bc52-4437-a5e0-36b9cd92b6c4", "comment": "Malware payload", "value": "d91b37a7029cd6bcdbf0d829e51c943aa8def9fbdd73da65c01216ce2008ba04b0b2646695d59d2a66207651cf831fde", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443009, "uuid": "72dee787-a356-427f-a87f-bafa85f32915", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443009, "uuid": "df557c8d-dda4-424b-9770-feb26dff928b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443009, "uuid": "13ca7eb3-ef83-4fa1-82b8-8c49faebc467", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618443009, "uuid": "1704c6e7-56a8-4f32-a5ba-06863b6faf9e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618443009, "uuid": "d3ffe6b1-fe3a-4c75-9fbf-aae949ca633c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443009, "uuid": "1f72e570-1185-4146-8822-174dcdd1600f", "value": "c32ef1fb195973b28c4e3edf5ede34b36ef6aa8c24db57f1bbba54ef3d1505d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa91f35-9d54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618427395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427395, "uuid": "4f66b0ed-e643-4ff1-bc21-ff68473b9124", "comment": "Malware payload", "value": "f28eba6d74c717b5db86db79d8a38481", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427395, "uuid": "3a7af385-60b2-49b1-b547-860a53a690b4", "comment": "Malware payload", "value": "c443d9a339d068b0e516473ba8322a4661a4a0e62fc6b49c65c990cd9e6aafb9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427395, "uuid": "537536e1-f4ad-483d-ab75-8040d3d2039d", "comment": "Malware payload", "value": "4c560bf2c71de8432b7d0915013f5ca1c3549a74", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427395, "uuid": "6ae8c76c-18e8-48d2-b325-4da4f1d44ac1", "comment": "Malware payload", "value": "0be1f20008cb47caa7a6d2474e110fc75e1440dd7637988bbb85c28e464d20ade83eb6b2fcc547a547d68534e10723cc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427395, "uuid": "5ac6d5e3-20e8-4873-ae6a-89a25458b846", "value": "55249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427395, "uuid": "115cc0c4-022c-46f7-94b7-c884f60df08e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427395, "uuid": "515c557a-c455-40ed-8c9f-cade3ea670e4", "value": "3072:j0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:CpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618427395, "uuid": "bdef5055-708b-4851-9139-45cc30312f8c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618427395, "uuid": "bca5c31a-8a7c-46e0-b263-7de2c747310e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427395, "uuid": "fa650b82-a3ca-463d-93c4-30b9216e9dce", "value": "c443d9a339d068b0e516473ba8322a4661a4a0e62fc6b49c65c990cd9e6aafb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76976158-9d67-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435326, "uuid": "d0415c54-3219-4e89-bd6f-4e493b80fdaa", "comment": "Malware payload", "value": "1e122553c98325e0a92e1dabddc03965", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435326, "uuid": "726da18b-4b19-4bab-8e0e-6349e03717cf", "comment": "Malware payload", "value": "c4723b7dc8729b63e8610532d4f64c518ae1aa36049b3661b775ad8b93971f24", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435326, "uuid": "6bffafae-2672-4606-b423-910db56fa1c9", "comment": "Malware payload", "value": "2e58652748c10c306d5a022ed1d63880a86b0ebf", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435326, "uuid": "920307cf-ae23-4e0e-a27c-706fa581b4d4", "comment": "Malware payload", "value": "0b832a7fdf48613916ea628aa15f7ef2bb288a201954bee41ec2f25a8e35aa4966932758fd88266ebca89b68c3ad8ed0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435326, "uuid": "0dc3990a-f6e0-463b-b291-70ec0c5e9818", "value": "A6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435326, "uuid": "8787f9f3-2cfb-46ea-8272-39b88ba20cb6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435326, "uuid": "669b4896-ed49-4ee4-9aec-90991d572dca", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435326, "uuid": "50df24b4-d11c-4b8b-907f-a241db6c3a62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435326, "uuid": "0955df40-848a-4ce0-8f58-0c3e8a4f2bde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435326, "uuid": "1b12033a-a870-4f44-988b-f09bf512d609", "value": "c4723b7dc8729b63e8610532d4f64c518ae1aa36049b3661b775ad8b93971f24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f160c7c-9d71-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439581, "uuid": "453b196a-a3d3-4347-81b8-25246e8647ee", "comment": "Malware payload", "value": "f1117365613e1489de88a9cd0f0aa18e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439581, "uuid": "78403440-393c-4317-a5e1-fe9fc8c768d3", "comment": "Malware payload", "value": "c65b11c4dc8cb3dc039fab2097b5903df71ed0fff387852b15e2d7dac733921d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439581, "uuid": "fd7dbef9-a650-409a-9b8e-c7e50300f09d", "comment": "Malware payload", "value": "fa62a03235da9e8adafac25b198a0e7bf2f016a6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439581, "uuid": "dbd93c3b-cbfe-462a-afac-bdd5e937f295", "comment": "Malware payload", "value": "d5ed3cd88007b632959da43ed809750055a36dfaf9dd26912a0c0fabf103cf526b3de5d409f3ac962e632f6b7a44f2bc", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439581, "uuid": "c587d8b6-1867-4478-9bc9-5de64eb155e4", "value": "4BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439581, "uuid": "13cf82a5-7df6-460e-bab6-f76644a9f478", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439581, "uuid": "e79fd589-111d-4a98-9170-430b77c7ce8d", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439581, "uuid": "2ccb8dd6-4658-4163-8c7c-999db2a6131e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439581, "uuid": "de45fa4c-b630-406e-9ea2-1d76574f3b4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439581, "uuid": "f11587c6-7234-4855-bbf0-a714d7057adf", "value": "c65b11c4dc8cb3dc039fab2097b5903df71ed0fff387852b15e2d7dac733921d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d72748-9ceb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618382099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382099, "uuid": "6894ee1c-e7c8-4939-906c-46e29ee8f1a7", "comment": "Malware payload (AgentTesla)", "value": "2b814d059370b9c4e0e8b82773ceb043", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382099, "uuid": "4c11e3aa-ebd3-43e7-93b3-426e288a84e9", "comment": "Malware payload (AgentTesla)", "value": "c6f7d3e1580a1a36525188b5e7b6fbdecc9ed04c7897f4d3f28feeac8d1fe986", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382099, "uuid": "e96a0269-09f1-43cb-9689-1e1b868c2290", "comment": "Malware payload (AgentTesla)", "value": "b545709f42ce70747473d39ef88f7678f932dd23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618382099, "uuid": "0fe8a628-1c27-40ba-9123-7f415a7483c6", "comment": "Malware payload (AgentTesla)", "value": "f43ac194042a2faaca11006ffd4ce0d773baa67dc97bb5b401a9ce3ba7d6b2bbcf375bf5b57f088d7010de0e14ee77c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382099, "uuid": "e7e236f6-9efa-417b-ae58-4dcc36a22b73", "value": "BAF40152AA9CFBABC41D17B5C45181B047778293D3A5EB5FEC9E40CC4AE5382F94C2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382099, "uuid": "c9d708ba-0641-4284-85b7-77b89abe7e37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382099, "uuid": "c3c00231-0a3f-4d21-bdb7-8c5ac53b5752", "value": "12288:8n7jbkqpu6a+0v0YMmXlRLHCWo9z7VTCCIIAtJaiwpIJ608jHwg46lNKl:snbkqNa+aMolRDCf9/NxaJaqA/VDPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618382099, "uuid": "d826fab2-e0ed-47fb-9553-24797911707f", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618382099, "uuid": "56ea61f8-9930-4a2d-a2ad-34b2c939b48f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618382099, "uuid": "7b52c281-8466-4d5c-b61d-9b598cf903db", "value": "Consignment Document.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f0c67a-9d3d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618417170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417170, "uuid": "c303cb1f-3987-4644-9993-3189a5182d81", "comment": "Malware payload", "value": "d7820f87f79f110a6020d9079258fe12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417170, "uuid": "1b4a9ea9-b57a-4308-91b3-1b2d8ad099a3", "comment": "Malware payload", "value": "c708eac65294c5cbda70ff5cdea537d06b798f4400f90e53f5c8a14041e84aca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417170, "uuid": "8de796d5-e71e-465a-a1ce-3caeacab8a78", "comment": "Malware payload", "value": "98b8dc3071d14ff1a076551983820647a9522cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417170, "uuid": "f7c5276c-310a-4de6-9231-caf8f821bc2e", "comment": "Malware payload", "value": "d3f77dc11f3f0c647980a2784f7ed9f89e0d59250b4d5911c785bdd1f179ace0b8e7f5b80472d9cd0a70eaaaee5e9445", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417170, "uuid": "3669fdd8-9d11-46fa-af03-aa7e536f1bb4", "value": "F5B2290E7B64C6A2C1ED1AB9C8A2622103B1A1475513DB2E4CCDD4EA5E37BD14AC0FDD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417170, "uuid": "01c2c240-9a59-4f0e-b339-e446cd1bc24d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417170, "uuid": "f3403d80-ba31-4fb1-bd78-777b5ca91139", "value": "384:KjfjrZS2FVVBQJN3j/H/PO8dj4eSEoc3TT6TzG/li/CQ:arZlQGujvHP7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618417170, "uuid": "3f8104ac-dfc1-425f-baeb-4d90ba2e3de2", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618417170, "uuid": "f54abdd0-25ab-4258-9584-f4ad92426afd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417170, "uuid": "31e9b4d1-3cde-4d79-9dca-b4b0a0f34796", "value": "Cu7W7R7t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2980ccd7-9d72-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439921, "uuid": "33194809-009a-4abc-820d-b580a15f40eb", "comment": "Malware payload", "value": "5d96d914a06248cb34039251c0ca390d", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439921, "uuid": "f4b06ea7-5fa6-4c6b-a7fa-016d1d5b4b53", "comment": "Malware payload", "value": "ca3fd81182bf83f3228df810e7c071235240a4b126d96b169c621dccbaf2d888", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439921, "uuid": "c1f7cfd2-c32f-425d-9da2-599636147d9e", "comment": "Malware payload", "value": "3477cdd5534fdeab875a865b84bfef1726f8402c", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439921, "uuid": "c69ef64a-ab05-49d1-a126-c6068d83b7f4", "comment": "Malware payload", "value": "8dfff18b56dd84f782c969c045acf0282b8d81e05c4a4acd5d27734b263856bbd414f4ccb6ab560ef5a3a0f860c224e5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439921, "uuid": "317cc7cb-a186-4889-96a1-c6fae236b3cd", "value": "7DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439921, "uuid": "662ec127-4076-4e91-9eb5-e3f51895694c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439921, "uuid": "95d5c1e9-a2ea-417a-9d45-64a1be39af5d", "value": "3072:rlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:rlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439921, "uuid": "4a935d65-182e-4591-9cea-a1e106777eca", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439921, "uuid": "7cf12def-3d26-4558-8941-ddf5439887d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439921, "uuid": "07fe3ed3-4542-415d-827e-309c72f7c7b4", "value": "ca3fd81182bf83f3228df810e7c071235240a4b126d96b169c621dccbaf2d888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4212dd5f-9d79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618442969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442969, "uuid": "b945499a-a8fa-4e2f-8d55-ec12d6feb80c", "comment": "Malware payload", "value": "7c38facdc17a05e43c8935ddb1f70845", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442969, "uuid": "f7d7a9e9-64a4-47f7-b048-0670346ce4c9", "comment": "Malware payload", "value": "caad455dedfd1ce9bab0e2b611b24a7bcb68ce6132f6760685cca500ddfeff9f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442969, "uuid": "cd77c65e-ec5d-4624-9534-f72c33c89f98", "comment": "Malware payload", "value": "d458362bc928f64fbb9fc9ab9c68e39c35435ce8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442969, "uuid": "5624422b-ae60-45fc-91d0-c96f3251c74b", "comment": "Malware payload", "value": "66d53cf11c362d18e89e514d48bb77a18aa9588970419c2a5099ffe3395e59b7220f01697335a9bb98a4dbe3993ca088", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442969, "uuid": "8b1deb3d-27fe-4b1a-a18d-a0c55b843dcc", "value": "9E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442969, "uuid": "457f28fe-f174-4583-a151-017dc6857ff5", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442969, "uuid": "077b1a06-4e6a-4dfc-8f6e-a53ecfb8b359", "value": "3072:G0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:FpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618442969, "uuid": "f6e588c7-8c8c-47a9-80b8-f7318f8b29cf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618442969, "uuid": "712dbb8b-a7e2-4661-93e8-d705de7ba5ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442969, "uuid": "7358d80f-b8e2-467b-a265-35d4d94b76db", "value": "caad455dedfd1ce9bab0e2b611b24a7bcb68ce6132f6760685cca500ddfeff9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50625dad-9cea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618381574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381574, "uuid": "936e675b-3124-488a-a22a-993abccadb21", "comment": "Malware payload (Formbook)", "value": "3685ad918d432e326f198ece5281448e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381574, "uuid": "b02ddc36-fc76-40a8-8c2d-14008231e457", "comment": "Malware payload (Formbook)", "value": "cc8fcf51279b2c357d1c648eededf4ac24c1d79bd9a88728adfe9b74b2f596c3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381574, "uuid": "97afc223-7603-4065-bdb1-36fb9463ba57", "comment": "Malware payload (Formbook)", "value": "65d01a3d2e697e4aa4653e938f4e9ee32d8b722f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381574, "uuid": "d160458b-b33a-4dca-90f9-f6b1db82d75e", "comment": "Malware payload (Formbook)", "value": "cf057c448b2bf1ef2dfd8b03f504aad9adf8765df1c519a6ace22e4b4916721f4830c33519567762026abe7dde1132ab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381574, "uuid": "2180030e-6c0a-43a8-bfc7-d5cf45e6e584", "value": "2705233CD81D718CDC47D1989153AE92D34FAE2B82DAC2D102DE7AADE3949BF453B184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381574, "uuid": "558e9f7d-e78d-4e92-a2a9-da6f510e887f", "value": "12288:If+5DqHXYb7ke2J/XqJ9ktjDkLotdyl32vNwq27pG8zwi4XCf6GBRQGvF0rBYs1q:IfuiKK/XqJqjDucW7pG88gfJJOhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618381574, "uuid": "cbf3a02f-89cc-45f8-831a-cf83b3512e8b", "value": 849071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618381574, "uuid": "9bd44bb3-487d-4b15-9565-44bedd7fcd72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381574, "uuid": "323c8cdc-bd3f-4af6-8c7a-cbddbf46336d", "value": "Swift Copy#0002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bec713-9d45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420565, "uuid": "1288c3c4-8888-45cf-9ec9-99cff9f5bed5", "comment": "Malware payload", "value": "7a5eb19df0ee1dec737605ea2b44f5e2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420565, "uuid": "31e6fe7d-3d85-4b14-b4f8-5bfeb5cad6f5", "comment": "Malware payload", "value": "cd21497da7cd077be9b9f8899a6654e08ede5fe7f3ec43c60b76f9e8eecd9ad3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420565, "uuid": "a9f8cd23-fb70-489b-9e37-faa5a574b2d4", "comment": "Malware payload", "value": "8e6b53adfeee75d3ece8a2c399d6eb9ef361d9a4", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420565, "uuid": "288a2aaa-a408-4115-92d1-ec2970d67ee2", "comment": "Malware payload", "value": "cccb3a96c47a4b5cf09b34c371e14135cb10be1740b34ec910ca3faef3c5b4c51730dc12590b4a2849e94bd72e603a09", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420565, "uuid": "358894fe-e47a-499c-9882-d93048394b45", "value": "9BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420565, "uuid": "4c60cb18-5d1e-4a61-87da-ad879987c07a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420565, "uuid": "41866861-2ad1-4c5e-b7c1-fc5589263d8d", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420565, "uuid": "f2584f7b-6a87-4200-904e-af4ba869969d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420565, "uuid": "b9955768-d211-46c9-94e0-3e7b501f6f80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420565, "uuid": "a84dc003-d5a0-434b-8718-cc99edde6be6", "value": "cd21497da7cd077be9b9f8899a6654e08ede5fe7f3ec43c60b76f9e8eecd9ad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd123db5-9d41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419123, "uuid": "615670a0-4408-4ba3-af91-c66aad275b6f", "comment": "Malware payload", "value": "a5d19a7f6076593c4ef717590b73ef99", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419123, "uuid": "b43bb53f-9b0c-4424-a58a-b6b53078f3e5", "comment": "Malware payload", "value": "cd653a6eaf40c3549cf78a840daba3a5f9077a0af3755e323357357b7e639711", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419123, "uuid": "d7136c5f-e40d-4582-8f12-62fe49e45b61", "comment": "Malware payload", "value": "6db14f832de1a9a3d7d8bf15990ab2bf7ad495de", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419123, "uuid": "f3caad28-647b-41c2-a975-c49307c3f9a9", "comment": "Malware payload", "value": "6bb034dda0c4266999be3331cd06ae08a9d0bc6abed29bd2357b1aae5bdd6ed7483275cf39c351801d5873fd554fd7ce", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419123, "uuid": "a4b1cec4-699e-4d62-9a57-8b39000dc7a9", "value": "7CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419123, "uuid": "ecf639bd-4fb5-41bc-8640-df50ba8448d3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419123, "uuid": "50763ccb-7d09-4c5d-97db-dee0c0fb3f5c", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419123, "uuid": "ef5fe59e-bf4c-4be4-b5ec-a23732b69efa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419123, "uuid": "73270640-d9c9-40da-a98e-853192b05fe8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419123, "uuid": "8d377c49-466c-43d7-8e4c-5c906f14f03c", "value": "cd653a6eaf40c3549cf78a840daba3a5f9077a0af3755e323357357b7e639711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfcd78c-9d38-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618415202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415202, "uuid": "dfa1da86-6c87-4e8c-ac02-b4158f100fcb", "comment": "Malware payload", "value": "3bbb71dd0e25475eaa222e20b92a9254", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415202, "uuid": "a05d48e9-3809-4cbc-8dd0-de6da5b92461", "comment": "Malware payload", "value": "cd65610abea4d14b8d6926b555b373a858e491de31d1ece22681901bbc745224", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415202, "uuid": "2a160166-d432-41aa-bf17-e20f4d4c9d30", "comment": "Malware payload", "value": "edbdd8e75de1155046b521ffa781a03a173730dc", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415202, "uuid": "7542cd46-f7d8-4b2e-98a5-c43873616016", "comment": "Malware payload", "value": "62ecd3e71c1a52809ab68de8048308bad3de7bb4be650600636e8acb0b6d1b568fce0f7ac1e70b486e95e4ab8d8a7237", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415202, "uuid": "d807373f-7ae8-4c7f-a9fd-ca7fcd37ec9d", "value": "F8F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415202, "uuid": "95060620-6a13-4056-868d-25f284dfb528", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415202, "uuid": "7f4eaa1a-b494-45c6-991e-26f8ef17bd78", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618415202, "uuid": "b6e2bd4e-7173-490a-b8e9-8c1c5fec1c2f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618415202, "uuid": "8c6f1bcd-9355-4b4a-bfc7-c5f8769b77be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415202, "uuid": "56de030e-83b5-44b3-892c-b17576fa118d", "value": "cd65610abea4d14b8d6926b555b373a858e491de31d1ece22681901bbc745224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbda6b7-9d63-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618433457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433457, "uuid": "f563ee8f-8edf-471a-b69c-3e56165a44a7", "comment": "Malware payload", "value": "e26353ab5b088d89f8554cf8a21e0e5e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433457, "uuid": "ee5b42ea-db30-4c5f-b2b4-5cc5bbd267d6", "comment": "Malware payload", "value": "cd7be8f6723dce7b19a3fb53f50fcba9208870feea4902331505bec792acecd3", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433457, "uuid": "db522806-287d-4571-b813-d215114b4178", "comment": "Malware payload", "value": "368a4de480b21bec5de18c3c84328ef4401a7f8e", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618433457, "uuid": "405fbd5c-3b9b-4f95-be94-2224ad3194a2", "comment": "Malware payload", "value": "04e2a69eec04e99f7227dcee0a05c8918ccd515460b05cfb2c88a9790caf3a5d9a0d12261e103fcc5434a319b5287d11", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433457, "uuid": "467269ee-6cd0-49e1-9645-9f76bfd830a4", "value": "D2249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433457, "uuid": "03788b99-549d-4f99-98d2-158cbdb56bbb", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433457, "uuid": "c41bf303-b016-43c4-bf10-7409affd2145", "value": "3072:m0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:lpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618433457, "uuid": "27fcc5c8-b8a3-4500-884a-3c4b5b15ad55", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618433457, "uuid": "db86db56-6162-4e76-92aa-387bc08f7e4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618433457, "uuid": "154f55fa-fb2f-4df1-a21b-a6d6d982c4f1", "value": "cd7be8f6723dce7b19a3fb53f50fcba9208870feea4902331505bec792acecd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d283e4-9d27-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618407681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407681, "uuid": "ac672630-aa58-4b84-95e4-1cb05bfc6b8c", "comment": "Malware payload", "value": "123845bf34727b6a4216027b7b43f6b1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407681, "uuid": "53dc070e-bca0-48c6-89ed-cd664277d2f6", "comment": "Malware payload", "value": "cdf15fc7bcbdf83dba4cc925748396c37a440ca51b569fd0e62aaea763e96c48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407681, "uuid": "6ae1fd8e-800b-4b76-9e98-40b2dee52f66", "comment": "Malware payload", "value": "7c00032166d7c2635fb5a3a526d6b06b9c52fd84", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407681, "uuid": "275c242c-2cc8-4dff-bf62-7abadb4174bc", "comment": "Malware payload", "value": "871accd68eaab8b7702fcfdedf4c2f0b8c497d6170115a7f7b7d806ba5725b84d8663dc4d9a810755a795e912011b4a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407681, "uuid": "c409d828-7dc9-4a7c-852f-f0d96eeb767f", "value": "3BC1AF416F92465BC9053AB80943E000FBD2076539475B0C527EF3CA87EB8B91E6B32D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407681, "uuid": "5e9d325e-1cce-4bbf-abe5-d6d94b216928", "value": "96:TOUIfPQrfsss1RzSdql2kyRZzESToxTK1kwII8Idfr0dnAuvGxY:T5Iftsqwtk4NoxTK1p8IdfrJuvwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618407681, "uuid": "7625667e-243b-4857-95c2-c5427dec6104", "value": 5760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618407681, "uuid": "0142b832-beea-4ece-ab3c-e5b476ea33b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407681, "uuid": "a306ea9f-acbe-434a-9426-de06197a4640", "value": "SecuriteInfo.com.Backdoor.Linux.fmhj.3920.26113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac03d48-9d39-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618415629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415629, "uuid": "2ffabdeb-6470-44c8-aa17-b745e3fd6c3c", "comment": "Malware payload", "value": "1369fb5bb5a4f4a0490671fc1d5ebe01", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415629, "uuid": "f2af3dbc-467f-4919-b5f1-8210e421f666", "comment": "Malware payload", "value": "cdf988a8f574f4a37a4c88a48d7fb923ed7a5d38ac780c5c869092ebb80dd381", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415629, "uuid": "0c9b64f3-78b5-4fd3-aa08-be58b412e07d", "comment": "Malware payload", "value": "9da85fb468d42661efa0adc8867c3ed79bd43133", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415629, "uuid": "df62e002-c9f1-49dd-b305-19006daf6dc3", "comment": "Malware payload", "value": "dda3c972b5f9024048a8bc1e7ecb1402009a515990bcc3bda597c226a363b4dc8b699024b46acf11611569336727aa10", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415629, "uuid": "c03f86a0-9e19-4791-addc-31dad609ac81", "value": "82F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415629, "uuid": "d57fdc01-86c4-437c-b76a-8d84e8fdf4aa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415629, "uuid": "c4607260-534f-4d4e-bf4a-e3adff2f6241", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618415629, "uuid": "0f4e0816-fb2a-4773-816e-2520bbc5d10a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618415629, "uuid": "2fe550df-d775-4c04-810f-5c6002ba7889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415629, "uuid": "f501d9f2-39a4-4831-9a9a-15e4a1c4cb4f", "value": "cdf988a8f574f4a37a4c88a48d7fb923ed7a5d38ac780c5c869092ebb80dd381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a13cd3-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425176, "uuid": "6f21b454-5693-4ad5-8e9a-71995f56fc2f", "comment": "Malware payload", "value": "45bd52944cf94d1187b95bd598f2e814", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425176, "uuid": "27b9454c-63e8-4506-836e-a8904b7894ca", "comment": "Malware payload", "value": "ce2f7719a46487ca6601fae406a43a33f0e7cccb8e5772cc9caae8c4bac6c6cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425176, "uuid": "3afce15e-aec0-4f67-a03b-b7d585387c8e", "comment": "Malware payload", "value": "e70ac1b036b83a1718664425bac4511bc8e7b495", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425176, "uuid": "969d308f-5b8f-41df-a6a1-9450194e82bb", "comment": "Malware payload", "value": "770b7d244a921a0a5df6c7764e53070e4956f12c4817be8fa0d92e811e9de727d650af25b5b34fde91d00fa2eb9e79ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425176, "uuid": "ec099476-8c54-4b85-9116-a2812603ad62", "value": "A7C423AA77D3B62BEE571D3025B2E7788FB7D2000797951353F02F5CE4729278A2A484", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425176, "uuid": "489ef53f-8d1a-44d4-91e8-b6ea3cafc7bd", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425176, "uuid": "3d63dc2e-c915-4835-bd1d-a0b012d2f2cb", "value": "12288:A7kFAhHcVUyiqTS0Rjfmb9iv9qCzL1C/li:A7kFAhHcyqTnN09qbC/li", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425176, "uuid": "aaf3f4c1-cee0-4d34-87a4-22b3d52cd392", "value": 545385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425176, "uuid": "8f0eab90-2cae-485d-80f6-9fea6272d79b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425176, "uuid": "4462c3a8-00f8-47d8-b191-30299335d84e", "value": "PURCHASE ORDER-38052429.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551cd7ee-9d39-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618415513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415513, "uuid": "37dbc53f-db44-4d00-a107-e5c1332acd45", "comment": "Malware payload", "value": "b44044404cdae7585c16dfdf5cb1843e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415513, "uuid": "1218cfcd-d8e7-4f57-a862-686902705ef6", "comment": "Malware payload", "value": "cf140f10ee7076a13a7ac3681493a6014b7549ef35e7342aa0af534c15380c0c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415513, "uuid": "ce68c52e-2926-414b-a712-25c2080078d8", "comment": "Malware payload", "value": "866997cb5e6c315becfe0ff9e3ae39520b4a041c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618415513, "uuid": "99ae5182-6852-4fd4-b364-79bf08312a61", "comment": "Malware payload", "value": "92c736da6677c2564b257fa655d80026a78e1dfe0f42d196858fc9865e1ae9a9436da0a9b08052a33381c76197018781", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415513, "uuid": "6e1a2650-7a18-4635-b385-03da73a726d1", "value": "C2249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415513, "uuid": "39b8b7e2-9bd7-46f6-8d41-4f489de0e11b", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415513, "uuid": "3efd7220-a3d6-491b-b946-eb6b1b803c88", "value": "3072:L0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:KpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618415513, "uuid": "bcf3f555-2808-4ed5-9522-a583dd53839d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618415513, "uuid": "9afb1a1f-890c-4b50-9fa6-682034abd87d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618415513, "uuid": "f0a4804f-6ea1-455f-96cf-d343406bfe1e", "value": "cf140f10ee7076a13a7ac3681493a6014b7549ef35e7342aa0af534c15380c0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3420fe9b-9d4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618423618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423618, "uuid": "a9ed9662-1cdc-45d0-bbef-0b863c682bb3", "comment": "Malware payload (AgentTesla)", "value": "201d64502b1ae9e79cee8043d42d246d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423618, "uuid": "54c39113-509d-49e7-8a27-e1f452bfba7b", "comment": "Malware payload (AgentTesla)", "value": "cf45c110c37dc7ff3c4d0c7a7d56675343d5439071332087b3da875becaf9266", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423618, "uuid": "f30bb7bb-1565-42b3-806a-b1e026d3b885", "comment": "Malware payload (AgentTesla)", "value": "0bdaf5559962432ae5af90acd65718058d408c9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423618, "uuid": "35cba8c0-f163-49d3-90a8-735cb2ce0337", "comment": "Malware payload (AgentTesla)", "value": "c1388549dba425ad14f9e8fbd835005e4bbafe496c7272c9660d9bc4ac76f24d3ac89619819a019277e3d76f13b9f276", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423618, "uuid": "03457177-e4cd-4def-af04-3874cf2cb8e0", "value": "11E423387EF60E7F6CB8EEA94DC154610C295A9DD6540B354F8B0A25B0399A12E7A3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423618, "uuid": "d1dfb0d8-a070-4386-b474-046078b1c1b8", "value": "12288:Prkl5Msy5CD2aq/rsTBTsTM2F1tbvab3Ux5H+hO89aBRYFsmzr1NHMrEL/+jY+L:ol5MsbzqYFTsTZntbvWkLbRGzjHJr0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618423618, "uuid": "3a062a8f-5e4a-48db-9a5f-21bd2a3e1d5e", "value": 710961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618423618, "uuid": "79757f26-090a-4ea3-bab7-44440a83499c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423618, "uuid": "7373f994-7768-48d6-8789-a665d273473d", "value": "ORDER 5211009876.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c86dc93-9d61-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432705, "uuid": "0112388d-a4ee-4450-a5d6-2e42cec65321", "comment": "Malware payload", "value": "7946a17e4a1f3fe36a20d2df1ac471c4", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432705, "uuid": "195492ec-ae79-459b-95ff-88c7e4762985", "comment": "Malware payload", "value": "cfa7b7f7b5e2167651b1074d9abac61d076cf63390d2645aba93ae9e8454b47d", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432705, "uuid": "de4446b5-cc82-458d-8cae-634c9c47c542", "comment": "Malware payload", "value": "c9d601b395aa4d702d6132ebb5294f9567eac502", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432705, "uuid": "2108d3d9-cfda-4ffb-93f0-3392a90eb502", "comment": "Malware payload", "value": "a7b7708169bf69ecfdcd9b02248eddb9a42e4b52bd1aff0180a9fcee08b7bb5e96aa200c62395852fddbd45cca571b22", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432705, "uuid": "9c7aca87-5ff1-4c2d-8d1f-d62d68f84e0e", "value": "C0F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432705, "uuid": "384e0444-18bf-4c0b-b62f-3601c63d3bda", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432705, "uuid": "d33b6e19-ec82-487f-ae50-e434cac117d5", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432705, "uuid": "bcdef962-09bc-4caf-a9dd-fa25c46031b6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432705, "uuid": "3a9b80ed-4f3c-4024-b8db-2d307232df12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432705, "uuid": "2c0b6497-09f0-4516-abbe-b1c683588ae3", "value": "cfa7b7f7b5e2167651b1074d9abac61d076cf63390d2645aba93ae9e8454b47d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd5b59f-9ce9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618381332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381332, "uuid": "e7f74928-371f-4341-9698-6b518d4657a5", "comment": "Malware payload (AgentTesla)", "value": "8a37068e2546f22dfa41b3354c89f96a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381332, "uuid": "31b51d52-cee5-4ed6-8586-bbf9a4f6ac0f", "comment": "Malware payload (AgentTesla)", "value": "cfaf2a1e319347dce73ecee82c0d0675caf292b21c91f18d1b6dbbb6d584a246", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381332, "uuid": "bc3140d6-7db1-4053-9fc3-945154148043", "comment": "Malware payload (AgentTesla)", "value": "d6304dab7beb51358fa489aebfa6c55b6f607927", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618381332, "uuid": "adadd109-f075-413f-be0b-aa413f15e82d", "comment": "Malware payload (AgentTesla)", "value": "7a4ff1a43f0ebf715666854d436ee4d5f5ebdac3d2a4286d54a6456a3996856678fc66168804630a3a7ae1dbec5060d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381332, "uuid": "e8a58b5f-f12f-460d-885c-a4a9f0ba43b8", "value": "842501323698A797E57E563844B2058002F4FD15A677DB1E3CF4B1CDAAB2B01876272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381332, "uuid": "205b4bd8-87bb-41b6-b5d7-3f5678f2d836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381332, "uuid": "b9dde450-75fc-4824-b669-8c9405e708f3", "value": "24576:mqpo5hlqA3KE0HkQvR23BVcleUxDswvI+78z/Oo5hrOQ5Gd:lIqoKVH1vOmleODscIfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618381332, "uuid": "858169a8-db66-4291-90d1-54b72fe6664d", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618381332, "uuid": "3a2b15b3-eb37-4953-8fe5-3c0b6ccf2c4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618381332, "uuid": "63f589ea-47bf-46e7-8ba1-d98f84bc61c9", "value": "HL-88352588 DOCAU BC ORIGINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e2b72d-9d5d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430949, "uuid": "6d590b86-3390-4473-84f3-0ec97c602e3e", "comment": "Malware payload", "value": "ba77342ab9d33b0a71f39b1468c8ecc7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430949, "uuid": "6f486c06-c02f-44aa-a928-ad26908e417c", "comment": "Malware payload", "value": "cfb4d9d88601857671661870d12f04d5e955b46883a2c20f48d753ebe15415fc", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430949, "uuid": "35509661-23d8-4f0f-926e-f7d71ad28c28", "comment": "Malware payload", "value": "0700403cd116a2c187cee9b60928cef358778a87", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430949, "uuid": "682a4c4b-c725-4718-9443-9bed86f023b1", "comment": "Malware payload", "value": "eb5e9c22a9f138e79d0e15a197f6167a3893828a84cdc8db21fe475179fc205e5535527aaa1fd8d4803e1b6e6d72385f", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430949, "uuid": "8b2496cb-be1d-4a29-9646-36915cd8280a", "value": "8E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430949, "uuid": "3cef4fa8-f5a3-4c57-972b-ec16c0f2415a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430949, "uuid": "1506d73d-a0dc-41e3-922e-f98fd57d076a", "value": "3072:Y0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:zpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430949, "uuid": "468ec206-1fae-464f-93e0-82163193a1e0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430949, "uuid": "68b78072-c06f-429a-9e4a-2ff032db9966", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430949, "uuid": "ea6a1234-3ba2-4848-92b0-85f40bb324a9", "value": "cfb4d9d88601857671661870d12f04d5e955b46883a2c20f48d753ebe15415fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf29a4e-9d57-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618428679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428679, "uuid": "df5ffdcd-ab91-441e-b5a8-c4c67623e8ea", "comment": "Malware payload", "value": "f9d9dd6d98e141fa25a53edcac0608b2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428679, "uuid": "04479b66-1573-4627-9dbc-242ed2c0c7ab", "comment": "Malware payload", "value": "d1abc0d4e849696531fc63e32d56d6017c74391494a0bc613a9209f831330b20", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428679, "uuid": "1d9ef75a-894e-42df-a670-fb19d42ba574", "comment": "Malware payload", "value": "91d1efcc8df8b2d8403ebbfb240d60cdfc31f388", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618428679, "uuid": "80ca04fb-c476-4f67-8ad6-53e2cc02d2f4", "comment": "Malware payload", "value": "901dabd1d41e59382aeaaf58db48e9419691ba6943a2194facc48279e79a18a8387baa420cda9617a5735f7b966f7753", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428679, "uuid": "8323aece-cf16-418b-adbf-2f410c175308", "value": "26F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428679, "uuid": "8d4a51d5-be30-4148-aa11-2c2d5a1117cd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428679, "uuid": "77541de3-018a-4614-9dfc-73d7c9150b10", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618428679, "uuid": "c97d3008-c821-49e9-a18a-922005a23df8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618428679, "uuid": "e368b2b6-febb-4c6c-9990-c52196177c04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618428679, "uuid": "661d880a-1ea1-45d8-b99e-1f6a81144d7e", "value": "d1abc0d4e849696531fc63e32d56d6017c74391494a0bc613a9209f831330b20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b4944f-9d42-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419374, "uuid": "8c0ce082-6a62-45a3-a9c4-b4fb535b22d9", "comment": "Malware payload", "value": "b15972a7fec57d515a4f6c2cb6a326a9", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419374, "uuid": "16cae09e-5826-4a43-bd6d-7ba3a0a0fba9", "comment": "Malware payload", "value": "d4af2fc3bc2246a4524815d578c7c92a95dca501294b9b967cff4d2656b51ae9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419374, "uuid": "afcb1cc9-e953-4b68-a04e-c2f3c10122f8", "comment": "Malware payload", "value": "33e9e3960893375eeded35e997958c30a45ad6bc", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419374, "uuid": "2e3beed1-dff1-4e78-b9cc-f9dbbe5942f1", "comment": "Malware payload", "value": "57034efdfbacbdc7a995135bedcc27b2839a086c6dc63966e6349acabf65849fe881f5b7f3f0f42ac80dcf051f1556f2", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419374, "uuid": "4be3540d-3ded-42b1-928e-4f8fe000b399", "value": "9A249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419374, "uuid": "d82c9670-d45b-4432-96a4-c1b75fa70794", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419374, "uuid": "255e96a2-325e-49b6-8f6b-d05ff0a6ac3d", "value": "3072:g0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:bpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419374, "uuid": "b0abb388-caa2-4270-a856-e4d058aa8e5a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419374, "uuid": "14eeccad-735a-44f0-817d-d3ff980f28af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419374, "uuid": "ad1a2447-0234-4833-b93c-e3830bad35df", "value": "d4af2fc3bc2246a4524815d578c7c92a95dca501294b9b967cff4d2656b51ae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2780810f-9d49-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618422308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422308, "uuid": "d4f7a312-d304-4432-8c32-35be6a2301a0", "comment": "Malware payload", "value": "304affbb9d812038662e752f1dfb8aa7", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422308, "uuid": "a84807ff-6234-4f1e-9a02-e5e67bf72335", "comment": "Malware payload", "value": "d4c0d5d17a08318da341bdb98aaaaa5cafbe8a4129884f0586b40305cdf06dd1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422308, "uuid": "00c472e6-c0f2-4896-b2c1-0200377cbc7a", "comment": "Malware payload", "value": "f2e9ee6552ac13b34c7770fdf5fa52b29bb0ea00", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618422308, "uuid": "249ff3d2-fd33-4ea3-8705-d25829549135", "comment": "Malware payload", "value": "031daad77e05a5223f6fe0f1066a3af6714306a2ca06b8187846b870d08f01b9e36ca7c1deb2954bc58185d0d289924e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422308, "uuid": "a5c049f6-62e7-4a55-971f-7734399673d7", "value": "5FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422308, "uuid": "6bb76962-d52e-4e56-bb35-11bededed736", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422308, "uuid": "b1f3b658-ef63-4b0c-913a-cde92895498a", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618422308, "uuid": "de22dd1a-0ae1-420e-9085-a933335252e6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618422308, "uuid": "0809b3cf-ae44-4f2a-b770-ce09879951ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618422308, "uuid": "fc3afc90-9208-48c9-a47d-a74d888e1c4e", "value": "d4c0d5d17a08318da341bdb98aaaaa5cafbe8a4129884f0586b40305cdf06dd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a98a52-9d3d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618417092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417092, "uuid": "78d791b3-1ea9-482a-b263-cc2b3ef2d251", "comment": "Malware payload", "value": "4dec6a2fa9265b85639d106252deb19e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417092, "uuid": "90d8f9c3-7ee4-4ae4-a6d6-3ac93aa6ca7b", "comment": "Malware payload", "value": "d7171baa32a17b0fab41ad80f70a103da88bdbe7e6275e49a10202ff1c5a4d9b", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417092, "uuid": "1c6ac5a0-29d1-4e32-887d-b7fda2e352f7", "comment": "Malware payload", "value": "7d004c55e4121f92eebc578a58e36be84bf9178c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618417092, "uuid": "582ee78f-ea85-41ce-9058-1fd6ba444f60", "comment": "Malware payload", "value": "bb4ecaa5437a0d8a882faa1151f49a12f6e412008c4314b94deef9ade7b048ca2a348c9897e11c0f2fa980349cd84622", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417092, "uuid": "9e604cfa-8ab3-4ebd-8549-ce997539e460", "value": "D1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417092, "uuid": "15aea2b6-755b-4d93-a510-02445885cba7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417092, "uuid": "d77abffa-ec50-4281-8ff8-3c567ad0ae79", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618417092, "uuid": "87f274c1-4f34-4ac6-8344-633d613d8cad", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618417092, "uuid": "33c8d92d-30f0-4c11-80b3-d7508d7ae92a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618417092, "uuid": "d3fba63b-e4a0-4532-afe0-d58cf928af3b", "value": "d7171baa32a17b0fab41ad80f70a103da88bdbe7e6275e49a10202ff1c5a4d9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2928d013-9d61-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432619, "uuid": "a6fc78f4-c3dc-46ea-bbce-591710c2020f", "comment": "Malware payload", "value": "11f6c2092b9ba0aabee048b25bf483cf", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432619, "uuid": "51bb5994-76a3-4912-8305-1b64524e36de", "comment": "Malware payload", "value": "d82924c66f5c15744401bd9bfbc941a26e2119acd18f6c2ef3e5724e6aebcf60", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432619, "uuid": "cc4fe7ff-bb62-4547-9d2b-05411571b8ec", "comment": "Malware payload", "value": "8b2c85d1154ecdae2ba9ed01466a161d5bb916b7", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432619, "uuid": "86b5fe1b-f720-400d-9b65-b02949f5f976", "comment": "Malware payload", "value": "0dfe466a4f13dbeb7d8269cbbc86ddb36fa0e1498beefe5cc982829731e16697d5b43896af806386357d4ec5f537638e", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432619, "uuid": "d1aea3fc-4c0b-4124-84a0-015985758592", "value": "C1249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432619, "uuid": "1d833123-8952-42ea-a335-524015fec9f8", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432619, "uuid": "801091cd-576e-42cc-88d9-8aa71738684e", "value": "3072:N0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:QpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432619, "uuid": "c86d8408-2a0d-47b4-99a8-3594f95e1d1a", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432619, "uuid": "e2cc333a-5c2f-4318-8f76-b9b9f03bfaae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432619, "uuid": "88050d4d-6f2a-4236-8125-b3037a103149", "value": "d82924c66f5c15744401bd9bfbc941a26e2119acd18f6c2ef3e5724e6aebcf60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf6a678-9d25-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618407176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407176, "uuid": "bb071f22-577c-4727-8fdd-7521b5e9bb66", "comment": "Malware payload (AgentTesla)", "value": "4be247eebde04bca372d23a8c4fbbf0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407176, "uuid": "2c5259b3-fb6c-4074-b2f0-ac04b09d04b4", "comment": "Malware payload (AgentTesla)", "value": "d896c589d591a9822f98b7caa8620029cfb1d1cd5dc78dd9b0c3152465b6810b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407176, "uuid": "78532447-f7a9-4423-aabf-f924f2d68d91", "comment": "Malware payload (AgentTesla)", "value": "a93bc1e07b9a5738370149810dcd78df131f6f3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407176, "uuid": "186b5ada-d8a2-4a2d-833e-7ef3310929e9", "comment": "Malware payload (AgentTesla)", "value": "2bce576de566449b2f3eabafaeffd98ca6fe22942fb30e8d618b83237e91ba8a633e95fb51341786afe73c3b003c7a1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407176, "uuid": "aeebe883-c5f5-419a-a54f-52862cf5623f", "value": "2E25E3293E98C53EE069DABCD23D81903EA1E487956CFACCD5C100AC65167D3B92F63D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407176, "uuid": "ceee4d7e-6bb5-43cb-9b8d-4540f2a73d59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407176, "uuid": "57100b82-4604-4be3-8f24-4b227829fd82", "value": "12288:Xp0SCTTshY8nq2eAQkY8Ng3OFcxpdwNrWkAtG1wQ+O+4r/7R8RMJV9hI9WpzD2Uk:8YQkzgscxY6tGFx+al8EUWUU6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618407176, "uuid": "a49a042f-de70-4fe5-98c6-b65b86656090", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618407176, "uuid": "ea4070a2-3cbb-4b8d-9653-8b7ab6ff5bb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407176, "uuid": "9f19e7a6-21d8-4665-93e7-8c83c4943296", "value": "103TRTRF011834681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96a0c81-9cf3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1618385724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385724, "uuid": "995ef5be-0656-4db5-9171-41f4f6085ca9", "comment": "Malware payload (AZORult)", "value": "3455f87da5d2a50c79506161412ca0a3", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385724, "uuid": "7593b104-5353-4f71-a359-e651c966a287", "comment": "Malware payload (AZORult)", "value": "da889f40e6ee1f71dbc8282fa19dbeee68f5028384af7f96f620bd4f23d2de42", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385724, "uuid": "1640988c-54a5-4160-9e78-3766da77cb5e", "comment": "Malware payload (AZORult)", "value": "c6234860a5b7a187c245e96638a4919bbef6966d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385724, "uuid": "be73bbe1-5f11-4e4e-9d93-8a2c30cacdea", "comment": "Malware payload (AZORult)", "value": "316e6d05a52097956ab32726cc49bf71d957bf486172f22a6b35dcd61b254ec16e45fed5aad2cf2ec5c8e17932d0ec51", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385724, "uuid": "5d81e930-704c-45cf-826b-43bbd36e6922", "value": "88F3021265E1ED77EA8695B70E27733BC3714A580525071B0BA82FBEFE52B43DB09342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385724, "uuid": "3a637907-6751-401c-8e83-0fa019130bce", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385724, "uuid": "b2b0f190-6876-4c97-af29-e56e986bebd2", "value": "3072:HyewmN4skJ659B2dBiwe0LDUf7HyE7buV/5lVow+e:Hd19BOUuYbuV/zWwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618385724, "uuid": "ea40d3d3-a293-44ab-a197-b0dae44fb529", "value": 157432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618385724, "uuid": "aeb55459-2128-4c7f-898f-a8ea02654d42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385724, "uuid": "9fa6b8f7-2b1b-4ae3-a5d9-eaf39c360dac", "value": "HalkbankEkstre0414217826353988773.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0524ce9d-9d27-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618407648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407648, "uuid": "2ce098a8-5723-4a26-aa98-fdc9cbe6871f", "comment": "Malware payload", "value": "3061e2d44678262f26d3f68a419bea3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407648, "uuid": "1ec70583-9ac0-4a40-a950-b259d2b6b080", "comment": "Malware payload", "value": "db23d6f5e2123cde47f4e3178bf18063aa3270d13499991200c9074a837eff07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407648, "uuid": "2079b374-dfe3-4cf7-bf88-7230229e4e2c", "comment": "Malware payload", "value": "546ad4d518a1ed317dee8bc1331249a10debebcc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618407648, "uuid": "274277c5-c634-4f48-a61b-0637259a4923", "comment": "Malware payload", "value": "1d9aa79ebe8dd5070830692393d3bfa147a9da59cd4838f8e53e30fda50f2134e60d121d50642c62c5a11c3b2d0887a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407648, "uuid": "cf285ce5-06fc-46bc-ae09-402fc3b91b44", "value": "5364F00A0A58D609D4421E31163E76380BA76FC62C61EF86BD53F2BBEFF37446506253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407648, "uuid": "19fc0951-faf1-4d80-8cc4-583722ab27b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407648, "uuid": "79d8f367-01cd-4527-b42d-7c3cb35e55bf", "value": "6144:O81mFtfUeAIQHuA36cdB0P2sWI4ov+0qnyQ:LKeeAItC66B0F3hv+Bnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618407648, "uuid": "3a7b70e7-a856-4439-9332-6e8a1fd6c202", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618407648, "uuid": "46d204ef-6036-45f1-b9f6-b115948ac2d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618407648, "uuid": "f2584fea-5c7b-4afd-b81e-ef1391f14b54", "value": "SecuriteInfo.com.BackDoor.Wirenet.557.20049.13436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8c814b-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425105, "uuid": "0311550a-89d7-4ea7-ae32-47935f14621b", "comment": "Malware payload", "value": "f264b8c58febaa3f3eea9a8c83c78cbf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425105, "uuid": "d0bf5311-30e6-46cf-b067-79ed98abec61", "comment": "Malware payload", "value": "db66b26d04c77e03bbf22957af34ba2b5817c397036ab8d4b7c222ec1b1ff40e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425105, "uuid": "005ed125-6a00-4ede-8c73-71d95ab76a2a", "comment": "Malware payload", "value": "36010881f4c3e15878bb3d5e76bc443d82827ebe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425105, "uuid": "1120e51f-0ad7-4e2b-8c22-86a15e0ac39c", "comment": "Malware payload", "value": "a1f85c8a7414cb7c1c019d864da410690866efb5b0540c417fe458d76f5c4ab51526b425f42b82f4a3e141dff9d7b51c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425105, "uuid": "182c5c93-4ffc-4838-9c5d-5d09515f8353", "value": "077412B632D1DA17CD5623719AE391D12B29FCA19F66A70F324AF70E1FB27844D12207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425105, "uuid": "acd2836a-bc61-4b9a-8ff8-f6abc6d21831", "value": "6144:Mk3hOdsylKlgryzc4bNhZF+E+W2knAHtEy77VYZfFX5qm1C8ewFsmX8lrTtW8LQH:Wf7+Zft5H0dos08l9ZLB/m9UCNB6xR+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425105, "uuid": "6100bda3-8d9f-420b-8017-5c7c0bf60ae3", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425105, "uuid": "ecffb8dc-83cf-409a-936b-3a23c8cd507e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425105, "uuid": "42a2cb91-533c-48cd-a3c7-a4ee232f27c8", "value": "PO_723_057_35.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7d60f6-9d60-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618432166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432166, "uuid": "360f144a-0b65-43a7-abc3-b778c1a63741", "comment": "Malware payload", "value": "d8a7f6efdf41fefd4a5fca77dd3bc089", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432166, "uuid": "c254b977-2959-450d-b854-81293a164072", "comment": "Malware payload", "value": "db787226e8b25176026194f1b14785df0643a8a9d479a0fca8616e3b0386ecaa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432166, "uuid": "569f89d3-8a42-4d25-9fac-714b2919e210", "comment": "Malware payload", "value": "d8c64d9a0eed3c07a6998a7f785fb80a45af53d8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432166, "uuid": "98d47743-f18c-4c9e-842f-2131266c82b3", "comment": "Malware payload", "value": "344758a1b6d85d261e8ea71e1566bf7129e0851d0b690f9ee503c0ed1eff17af65d9a5caa9b0cfa622156879c4ead82d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432166, "uuid": "a2be90e1-509f-426c-81ed-1a6d2942cb72", "value": "1DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432166, "uuid": "f6cbcebb-5288-4a76-9392-177063e80232", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432166, "uuid": "a6377ae1-e7a2-4a36-ba31-e22ebc0142d8", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432166, "uuid": "2bfb49ea-9d4a-44b2-959e-c0b014751481", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432166, "uuid": "300f6834-cbff-4bf5-b019-88ef7349dcc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432166, "uuid": "5018027c-6d05-4afc-a585-e939ac47ec16", "value": "db787226e8b25176026194f1b14785df0643a8a9d479a0fca8616e3b0386ecaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dee2e3-9d5b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430283, "uuid": "4bd59aa1-c8e6-4c05-b185-467e1c70f607", "comment": "Malware payload", "value": "4ee86a27988245a51879a7797e7e6239", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430283, "uuid": "4fb7d032-8596-45ac-be47-68cf22fc3ef0", "comment": "Malware payload", "value": "dd1d3329dc2a0b7f4a222fcd07d276f57a257123fb8367a91aaca2436f661c7e", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430283, "uuid": "0e70cf20-5ec8-4b22-b404-e20912d5ecad", "comment": "Malware payload", "value": "d0718b02f4161ce5d3a8235420ed0fce54a2914e", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430283, "uuid": "73bf98e3-d89b-49fb-a509-7ef2fb8048c6", "comment": "Malware payload", "value": "0521b40919690e7a1cf294cbc7b9dbc7b73aa5c94127e2de26d612fce655774ae728cb7a51defd8ab26240177ec37621", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430283, "uuid": "40bc81f5-2fe1-43a8-8a7f-79b1dd8d6a59", "value": "C6F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430283, "uuid": "8789155e-4fbd-4539-81cc-4e47ce5c4fac", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430283, "uuid": "1f1dc99f-e5a1-4d6b-863c-9f29525225b7", "value": "3072:4lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:4lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430283, "uuid": "732e3e43-8a76-4862-86e3-52e14fdda977", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430283, "uuid": "e277ed82-f520-46bf-a7da-0c9c65527bb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430283, "uuid": "f6ce761b-b5a5-4406-b3e0-cf98772aadb9", "value": "dd1d3329dc2a0b7f4a222fcd07d276f57a257123fb8367a91aaca2436f661c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d23da5-9d4c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618423621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423621, "uuid": "15330dfd-c0fb-44d6-8706-c70ba6c08dde", "comment": "Malware payload", "value": "71a3be0b69728559811ebfc9726a23e8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423621, "uuid": "3043b74e-dd11-40f4-8846-0b35d65072ea", "comment": "Malware payload", "value": "dd22888ccb55490793e309e6250b1b20943bcd48342da1d7bf6f59709950b920", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423621, "uuid": "c7098a0e-d4da-4d8a-8a2c-81d613c10686", "comment": "Malware payload", "value": "53e0870e69427554300632dea609906b2f7fa6d0", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618423621, "uuid": "efb77e43-6ffa-446a-a162-d561ab0a0700", "comment": "Malware payload", "value": "958833b7698ba016e8027fa94eae872a3d6cb506d3689330b0930e5278445fa426a4dd2df696e39ce2c17e2a08ac9453", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423621, "uuid": "68f8f43a-1945-48e9-9041-9d5772f7e9a5", "value": "81F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423621, "uuid": "e649e4bc-2953-4c62-a1b1-b914362d829a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423621, "uuid": "af886e58-4dc0-4e59-b46a-5245a48807f7", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618423621, "uuid": "20a76174-9494-4a2d-a5cc-60a5ba8732fb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618423621, "uuid": "c80b99e0-cfab-40c1-aeb4-1ddcdb3099b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618423621, "uuid": "32b7f549-e5cc-40f8-bc1b-f0b3258eb008", "value": "dd22888ccb55490793e309e6250b1b20943bcd48342da1d7bf6f59709950b920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcb203a-9d52-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426506, "uuid": "a247f9eb-e73e-4eaa-804a-283b79cdc9d7", "comment": "Malware payload", "value": "da4891080b18254e99be6b42c506a152", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426506, "uuid": "97ff5a0c-6044-4cd9-89c0-3b45f72d5f36", "comment": "Malware payload", "value": "de7106ac73a41f059d16c4004a0043bc3881c8d1a6a62c16a9ea88ace140e496", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426506, "uuid": "48547a02-76d2-4d78-8a39-7e4b623f0a65", "comment": "Malware payload", "value": "b4adc5c112766fb59b4eb79ea5f953783b0145be", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426506, "uuid": "2b1e66af-0e0b-4ca8-9f55-46cefc85e7c6", "comment": "Malware payload", "value": "390bf32661438ac542ea64775970ab507e04a4f2075ba1468b4dbbb091b94066b78eef951c83f1a3d3556f1a43c7229a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426506, "uuid": "10db50c1-a16a-4478-bccc-73d5cad9714f", "value": "71F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426506, "uuid": "14ffd89b-322e-416d-ab9c-99e354cf628d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426506, "uuid": "9fbb00a6-0484-4b36-b23c-f7a4fd4d803c", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426506, "uuid": "1627122a-514c-4fd3-bd48-73a3353b66b1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426506, "uuid": "b82e2c42-b071-4d57-87e0-e9877d5a36a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426506, "uuid": "3f3dedeb-3231-4f6d-8485-1f059df1e2ae", "value": "de7106ac73a41f059d16c4004a0043bc3881c8d1a6a62c16a9ea88ace140e496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58039329-9d7d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618444723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444723, "uuid": "291bf969-2dcb-461c-b21e-d105a9c5c3dc", "comment": "Malware payload", "value": "f40a19f4ea44d610544db4073a4f90ba", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444723, "uuid": "7f6dc9f2-f21a-49b5-b567-40144dd67957", "comment": "Malware payload", "value": "de84e58544fa1c044aa741c70a5023a01e16145659e22c1173e91a1d2dbabca6", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444723, "uuid": "9f41fc62-6ab7-4346-ad58-e6878289bfed", "comment": "Malware payload", "value": "bbfed702f6814b46cf405ee30b89396e788ddfb9", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618444723, "uuid": "77fa7269-6ec8-4982-b61a-3ee09f83d7f4", "comment": "Malware payload", "value": "f1e1c58c4015496e1a0469e9938a3cdaa5c1c47eb29a08bd64e33c2c97d0d3215fcbea9c9d4cfad82b219827dbfc351a", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444723, "uuid": "856527b7-2ba6-405d-a058-0fe9bfb00f2f", "value": "57F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444723, "uuid": "a16d6231-6229-4b71-b2f8-a96a898d121a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444723, "uuid": "2c00c0e5-b412-493e-8a49-be46b2f8d4da", "value": "3072:zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618444723, "uuid": "76027396-20ea-4054-8ff0-0a0a8be286fc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618444723, "uuid": "b9fe4c1a-d668-43ed-ba53-063318f3d489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618444723, "uuid": "04b0a115-1b14-44b5-9b7b-8b33fc16fae8", "value": "de84e58544fa1c044aa741c70a5023a01e16145659e22c1173e91a1d2dbabca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a6a695-9d7b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618443886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443886, "uuid": "72a1f985-f2c3-4dd4-9655-a3032ce4af7e", "comment": "Malware payload", "value": "9cd377bd2e580af8ff7e926c12197679", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443886, "uuid": "4a8925d0-8e9a-481b-83b2-b3bec2e16399", "comment": "Malware payload", "value": "de9e4357096075e93dca27588d9375230ec7fdd07d6af93d413ebbdae014b0da", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443886, "uuid": "bd1dc355-ffce-4a7d-9821-46ceaf8d6a14", "comment": "Malware payload", "value": "398b263451629caa107c39524560f0a8a5822300", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443886, "uuid": "c24ff6fa-50f0-4df3-86a7-c8dfc63f7d70", "comment": "Malware payload", "value": "e6799bab08b5b6416a13b3b9a437b70d682c28495b19449bd845a5019161c8f33720c9f6b207336a01a8684d2b5c13bb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443886, "uuid": "fe1d3f85-e4d5-4686-8593-b7d61e1c3778", "value": "6FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443886, "uuid": "00e216d8-0436-40fd-ba3a-84abf58a8ef2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443886, "uuid": "80c1b50f-623c-433f-9340-68cbbb488588", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618443886, "uuid": "ebb15764-1efe-4223-9d97-940f38fc7d1a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618443886, "uuid": "cefc1d3d-5176-4664-b356-3d0352471e1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443886, "uuid": "74ce6cf4-0baf-4b63-b853-45727be683f3", "value": "de9e4357096075e93dca27588d9375230ec7fdd07d6af93d413ebbdae014b0da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb67e547-9d79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618443199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443199, "uuid": "edf05e38-f76b-49ce-b9b8-18686e2a2845", "comment": "Malware payload", "value": "afbb3f7fc4ed1b327301efdaabfddbd3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443199, "uuid": "79a50e71-725a-413c-b7fc-ad163c3b006a", "comment": "Malware payload", "value": "deed54ad746109b56287c36214f4f69e06251b33cc3f5b3d09ab46ff2431badb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443199, "uuid": "e3f6ea4f-9827-4441-ab3a-e912cb5a7603", "comment": "Malware payload", "value": "1c8e1577b210f82f08ed1fcb7ced71c696e0fdc9", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618443199, "uuid": "ff1f881b-30c4-4911-b28e-090530407276", "comment": "Malware payload", "value": "2363f15ab260789a257f9dc81e2b012cef69f41a47d40819072225b768c878225e5a61cd64e5987646cca064a03ce9dd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443199, "uuid": "5b43d544-ce1e-4f4e-b750-ed18878b37a9", "value": "5EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443199, "uuid": "8c3173b4-1f2e-4441-bbaa-12d58a2ec7d7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443199, "uuid": "62747ed3-8247-4c2c-a92c-60782747b512", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618443199, "uuid": "7eb64352-f3f4-4585-849b-b4f1c246e254", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618443199, "uuid": "ffa2dbd4-6a75-4225-880a-28352a8249d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618443199, "uuid": "9470e518-1cb2-41f6-9e35-fb9750453ef7", "value": "deed54ad746109b56287c36214f4f69e06251b33cc3f5b3d09ab46ff2431badb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4db5308-9d43-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420076, "uuid": "06332b55-b88c-443a-84e7-50657355bbb7", "comment": "Malware payload", "value": "8c633730d92b20b3487659a8e4fc733e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420076, "uuid": "5daf46b2-8dea-410b-8e7a-c166829339e8", "comment": "Malware payload", "value": "df096a3a099a64644a5a04a5d812f7d3c3bec4c95828b917af7b5c5742d8375e", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420076, "uuid": "fe81b6ab-2120-41d8-bbd3-2899f7c621ae", "comment": "Malware payload", "value": "63cf46410415618924f2f65f7bd759eec04ea081", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420076, "uuid": "0eed49b4-3629-4e65-9b2c-8bcc819c5b26", "comment": "Malware payload", "value": "6166a4bdd790994e18c18ec0c694d81953eb2f287c63318cfd810a4e502eccbe55afdcddcc4e2b35c1ad3bc992dde189", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420076, "uuid": "df9f8652-8eee-4adc-a708-e107b74bc696", "value": "B4249D8DCBB6D199F6E3EAF00082A36250A33D11456E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420076, "uuid": "b0b2af0c-6d32-45df-9f4c-c1860b55dc12", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420076, "uuid": "60d0ccf2-665e-48a9-a6cb-6fd936cdd724", "value": "3072:T0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:SpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420076, "uuid": "b4927400-e13b-4fab-9940-fbd12b2208eb", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420076, "uuid": "353f1857-d2e5-47f0-9cc7-347fcbbed1a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420076, "uuid": "019ac791-127c-4e36-99c4-1a6b791efa10", "value": "df096a3a099a64644a5a04a5d812f7d3c3bec4c95828b917af7b5c5742d8375e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f0c371-9d6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618438950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438950, "uuid": "9a58e043-5cbb-4619-bc07-d0e890f6213c", "comment": "Malware payload", "value": "0ff1edeaaae08ddce95e1ff90cd6d2cd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438950, "uuid": "aafa6d8e-3fd4-4a26-b228-bec5f40b9a43", "comment": "Malware payload", "value": "df1053b396e42a35197574a774d830a4fae79e9a62357c6c9ad24ed750759117", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438950, "uuid": "87b82210-5f7f-4e8e-8a0c-e9689b6f6387", "comment": "Malware payload", "value": "1c583331c3855015f217ff1b3ecb61b35e61f9dd", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618438950, "uuid": "14ee37a8-0708-40fa-b586-19616b2cf6e9", "comment": "Malware payload", "value": "9e036b83c8e6494a97102084af14ebd9f493291e26cba593de4b1a7d3d10d9824eef8ad825f7e6a01ace0bba771466e1", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438950, "uuid": "03571c95-7026-47cf-b449-3bcf726a0c58", "value": "31249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438950, "uuid": "501eea3f-6678-47e3-82c9-22eb5db5f809", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438950, "uuid": "8d4ccee6-e735-4540-b4ef-624fc56faaab", "value": "3072:60DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ZpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618438950, "uuid": "4affe87b-6a75-4072-9cab-4aec7657d08c", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618438950, "uuid": "495f0114-923d-48a4-a1a9-68b1ef1e7bdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618438950, "uuid": "e71cb8e4-d669-4f42-a11e-d780554bfaff", "value": "df1053b396e42a35197574a774d830a4fae79e9a62357c6c9ad24ed750759117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc84d9c-9d41-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418908, "uuid": "4d6664a7-3dc7-4840-b187-50b51ef8fe64", "comment": "Malware payload", "value": "c546c10fbb0d94b8c4c44a9c6b8aaf72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418908, "uuid": "2e893c02-80cd-4a8e-9485-00031a743661", "comment": "Malware payload", "value": "e178c5e353b39f8ccccc29743235e6d4b665c8dca955ba30da70fdf275a9e30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418908, "uuid": "86bb1763-b6f2-4b93-94be-2f085bc22889", "comment": "Malware payload", "value": "6e57868fc73f5db80d62e079f4d99d07edbc9eb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418908, "uuid": "da57a340-2023-4139-9d7b-8258fa38ec12", "comment": "Malware payload", "value": "d62eccf4fc5915d2a389b93ae45bfbb074d13362f5a9324a1258b9875ebd7fc97512f035801018917ab377732b4e9480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418908, "uuid": "32c9816a-d5f2-4066-a4b2-b6dd445beb42", "value": "A715E01167D5AA04F3BE6B3BC8B5182057FAFC43DA32D6AD1DA634DD0AB1FA49121313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418908, "uuid": "227281f8-d93e-4cf0-bc2e-2cafbb40eb1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418908, "uuid": "5272a3c7-cfc0-4c5c-b91e-c2e958df9a8c", "value": "24576:x2jJAOGbBpRc5VQbQiMh7mg8MsFZF+DH:x2WbbBpRc5VMQ/aM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418908, "uuid": "4244ae1e-c80e-4996-b865-bc06951e76ba", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418908, "uuid": "9d16e063-9f7f-4f60-8d8e-02b8a9c5a2e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418908, "uuid": "e5b6789f-35fb-437c-a73c-c77511f1e864", "value": "Rq61Y5RcwlxFtxe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdb947f-9d45-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420953, "uuid": "35a9b925-fa03-4d50-bee3-5e38921288df", "comment": "Malware payload", "value": "7f44c3284c3fcc47ad29c0de2202769a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420953, "uuid": "e5bfcc22-0da6-469f-8bcc-358d866fdde6", "comment": "Malware payload", "value": "e2a3b6f2f98a7514c484c1ae690b04544e80a09db3f4dcda1c57f4ead2cb87f2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420953, "uuid": "7915f225-f685-42bf-9c6f-cc21f9f94633", "comment": "Malware payload", "value": "689d39897f4094739f6ed140fe35d77c004c86c8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420953, "uuid": "eb979901-1411-4dda-bca5-9e89a0599a8b", "comment": "Malware payload", "value": "2036d9192c4bde0cbf8e88ab9f3cf4421c6a2ea85a5feb8768e87df616d85c6288b82f6b3855c3e77d4d922794bf25d6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420953, "uuid": "cf0df36d-40d2-4366-bb11-d77639685934", "value": "6B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420953, "uuid": "41df7f24-77c9-4a60-9430-ffe5a97b40fb", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420953, "uuid": "f341513e-d2d2-4a23-a667-c0cb53d037ff", "value": "3072:90DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:gpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420953, "uuid": "ad9e30fc-c8ec-4a44-bc4b-b884b1f70e06", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420953, "uuid": "e64c9d88-be2f-4651-ab4e-ac36cc3c4ec3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420953, "uuid": "52e22b20-78f9-4e5c-96ea-773815a81528", "value": "e2a3b6f2f98a7514c484c1ae690b04544e80a09db3f4dcda1c57f4ead2cb87f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be294b42-9d2c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618410105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618410105, "uuid": "741917d8-ce22-4f8c-a271-22b35ed19779", "comment": "Malware payload", "value": "199d678c1621154fc9dbfbbfa8e4eb84", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618410105, "uuid": "72cd0227-4df1-446e-880f-39d0e31168b8", "comment": "Malware payload", "value": "e2ab25af3d2afca63e15834e948adabccbe4d649710ad80c1cd02eb879b999eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618410105, "uuid": "d9dfe4d3-30f3-4f87-9516-786e1cc63864", "comment": "Malware payload", "value": "e8af6bdcfe91e25625405b8eabbfb201240d2303", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618410105, "uuid": "c952ff09-df57-43cc-96f3-586d80525705", "comment": "Malware payload", "value": "ed655369ec5e4d06aee984b0793aa1fe11e033d39b6b129ec28f48246ec0ddecda81ce34febb96c43cadde1c90750126", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618410105, "uuid": "04a0ec56-b525-4bdf-8ea1-e9179ddded89", "value": "D30462BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618410105, "uuid": "ddde4cf7-3698-4559-87a3-131a1de2503f", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618410105, "uuid": "ec123cf5-8cff-4872-b251-37127b5f07e4", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618410105, "uuid": "323f5666-bbf7-4c09-bd86-91e4987a98e4", "value": 174577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618410105, "uuid": "aedba47f-4b28-48c5-ab1b-9d99dba55e1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618410105, "uuid": "3f9411bf-ea2d-4568-8bb2-fd3b6d155100", "value": "ghnrope2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc8f654-9d21-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618405486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405486, "uuid": "ba09b489-a1e0-4024-baca-66f88f355d2f", "comment": "Malware payload (AgentTesla)", "value": "1e5df6543d3bda96b2aa4c878579f300", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405486, "uuid": "50efde7d-7ba6-4d90-a193-e4a065ba99c4", "comment": "Malware payload (AgentTesla)", "value": "e5194d56d24ac40c2a7baaddfdf34d79df14fc84f8c5b6cad05e0d6790d51560", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405486, "uuid": "0693007d-9e45-4543-8f08-049bd5fe892a", "comment": "Malware payload (AgentTesla)", "value": "6620be4635f20852b57c82ae0d74ed8df687a70c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405486, "uuid": "85cfb504-f405-4976-915c-77019008d7b0", "comment": "Malware payload (AgentTesla)", "value": "bf13a16dbd3af7687eca99fa33ad6e6b71aef7424c0f2a6a104dbefcd3d8926c3df34bb971c60c37bef8264cf5f785fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405486, "uuid": "3e2ce2b1-dad1-4474-b26e-9465ed9e034b", "value": "C0E4337C7406E783AE57286D1F2FDEF706E0AAD8AF7EF9A05681D91B1C9618436700C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405486, "uuid": "e3ec4fb7-2193-4bc9-ab73-0d0267de1de4", "value": "12288:Dapxf8goUARU9BWk6L+gfkqZYEhTPdlY7p61zMvAl5kXouqR2XzDl6Za8zskbgts:QBCUAdpkMYEhTPHM61zrkXJqcX/Azzsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618405486, "uuid": "dfd0b446-87ac-43e7-a7ce-4a735b60247f", "value": 711982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618405486, "uuid": "1d345525-dd06-4b93-a35d-ac5b7b9233fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405486, "uuid": "a352ba3a-1675-436a-91e9-afbf78c34d9d", "value": "HL-88352588 DOCAU BC ORIGINAL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e7f4c8-9d6a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618436769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436769, "uuid": "5671db6f-464e-468a-a095-a4ed832409b1", "comment": "Malware payload", "value": "9d6a885c14a58e2a5d08d1b6994c3af5", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436769, "uuid": "dd64b0d2-e5cf-463c-94b3-19def31d4922", "comment": "Malware payload", "value": "e5fdf1fc68a758fac198b80da7725aa0c71a1e20d584f4b59c202a1d1810efa5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436769, "uuid": "84dff9d6-275e-4672-8859-85087ecb561d", "comment": "Malware payload", "value": "a38e0f499ed6fefecf31feee0fe1b28b5d89d08a", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436769, "uuid": "a215f80e-9991-4454-a831-1b99e60726c5", "comment": "Malware payload", "value": "12405e2691ea41d72d78b70fa1d7e5cd0e9fb253b04711c41e06d526adc95c4b27ac92bbc4dbe96794266dcabf5e20a8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436769, "uuid": "8d999973-a42d-4469-81fb-8b7cfc5ef8ba", "value": "8B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436769, "uuid": "bc24bf4a-9da1-45c8-b73c-c75c465f47b5", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436769, "uuid": "415be867-cb4c-4a21-83cc-3996591f06b8", "value": "3072:J0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:8pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618436769, "uuid": "985593ec-9cd3-428d-857d-07ebae6f865e", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618436769, "uuid": "b11d4d7e-2423-4343-be96-dceab91d1480", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436769, "uuid": "781cb98e-7d4f-4628-853a-3a5a9daa7d96", "value": "e5fdf1fc68a758fac198b80da7725aa0c71a1e20d584f4b59c202a1d1810efa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b945e6c-9ce4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618379043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379043, "uuid": "fa8dec19-ccb0-4f56-8921-fed9d2b1678a", "comment": "Malware payload (AgentTesla)", "value": "261afee6787397cac81771aff9458646", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379043, "uuid": "7abdaf5e-e5a6-42b0-8410-34c0d3e40fe4", "comment": "Malware payload (AgentTesla)", "value": "e6c172dc7204b72c1e0ee92e91e6a26bc5bcccb839718e732b19b42e76a880d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379043, "uuid": "b8e303e0-4c92-4516-a45a-7d137998a067", "comment": "Malware payload (AgentTesla)", "value": "e63b9f8d26edc2a840e26e7ea216eb4c1ad36e2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379043, "uuid": "e3475ae6-ba28-4b0a-9b32-7003ad5feeed", "comment": "Malware payload (AgentTesla)", "value": "b33c84fddc77c2a4e8711144a6318829f003aaa28d2c87c247a3b50139d393940a78646c3a4ca0f5d940ecf59f2d7eff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379043, "uuid": "f54e688b-d2d7-4e02-a6f4-9f9b1574f798", "value": "01E43330FC18C7771EAA6845ECFED5C8D654ED03F95A09AA9087D3480223D7814E6FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379043, "uuid": "af3e6093-940e-45dc-a3da-91d7e96f21d4", "value": "12288:EFEYMHWgLVM3IublWQN4AfGPvLrm2LN3B+aV3Op/l5Vtn:SMH/L9foGPjrL203Op/l9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379043, "uuid": "716cc6eb-42c8-4673-80ce-04e10dd59613", "value": 661477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379043, "uuid": "ae7cd5b5-8f1e-4e1a-9c8f-eb0845dfedb0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379043, "uuid": "9fde5293-5ee5-48c3-9a5a-fd09c0e4d62d", "value": "PO_103.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a44d9f7-9d22-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618405697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405697, "uuid": "2ee935b9-86a6-4eb3-bbc3-9cebc2a62691", "comment": "Malware payload (AgentTesla)", "value": "f3cf339fa188173e6a12fb3e8fb5033d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405697, "uuid": "81aeba01-91b8-48af-b9ef-f801a3cacb7b", "comment": "Malware payload (AgentTesla)", "value": "e70d1958db5ff44e5bbeb627b3baefcc79a153df4eb262cb9aef56c7ed555d75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405697, "uuid": "7e103661-b52a-438c-9dfe-59bdfd3cc635", "comment": "Malware payload (AgentTesla)", "value": "2799bca299f59593b7cd5e17781ecd4a50604460", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405697, "uuid": "b4018cb4-70a6-49eb-9858-a53fa97b44b0", "comment": "Malware payload (AgentTesla)", "value": "ab81c69dbf2559ce268c6ebf1f7e23f583d4a4cec616a30836d984a902c1468402a88836b2a839ed6ded89c31b489d83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405697, "uuid": "d9aecbce-3d91-4f47-abeb-eafa27e8d1ad", "value": "2505E12123EC8B15F6BF7F78693212650BF1B846DB35E74C3E9140EE0AA9B518972353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405697, "uuid": "c11b65d6-da29-4859-afa0-ce51ee8e6231", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405697, "uuid": "39e61902-28c4-4488-b980-e42ce002cc7b", "value": "24576:YSAP94yqudTPpG6tzt6fJAcZ/4BzGQgtP:1AKyqup3zQCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618405697, "uuid": "c8ab2385-c1c5-40d1-a22e-aaa9fb0cb879", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618405697, "uuid": "a379b26f-cd88-4257-9783-27280e1338e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405697, "uuid": "b58cee91-4d6f-41b5-87e2-a31b38939650", "value": "HL-88352588 DOCAU BC ORIGINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11aefa2-9d46-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618421358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421358, "uuid": "43d44876-9121-426f-a564-6e09ce4473a8", "comment": "Malware payload", "value": "1fc75bb73fbecda418fc5112b8efed37", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421358, "uuid": "dc7e891b-6451-4bb4-b498-5cc190ee47ee", "comment": "Malware payload", "value": "e8bace7351829cf79112831b72f4b386f752c26c27008c59cc746d24ca70e717", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421358, "uuid": "5578d693-046c-45ac-b852-a75136964e80", "comment": "Malware payload", "value": "56c456d38c4cc6812bc7f6621630f658ccae6540", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421358, "uuid": "e4ae7f4c-151f-4ef1-88e4-02519ea3d7a0", "comment": "Malware payload", "value": "c1c6d45d1dc41b6bb2254728acab2a62651b9b301e9ec1f4209768185670ea69fa6d4c1ab8cde2b9bf862199f58f2cae", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421358, "uuid": "c78ccbd8-1d20-41a8-ae3a-8634bf83e962", "value": "E4249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421358, "uuid": "73990713-56c4-40b8-8590-3ffd31eecbeb", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421358, "uuid": "f14e73e4-fec0-42c2-a999-52bee1c43279", "value": "3072:A0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:7pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421358, "uuid": "0c62d913-c404-4432-999e-5f4617ad17c0", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421358, "uuid": "190e1c42-a093-4728-9905-777e467b9fe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421358, "uuid": "1e106e9e-2add-4229-adf4-f1bc32f61817", "value": "e8bace7351829cf79112831b72f4b386f752c26c27008c59cc746d24ca70e717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a7cd39-9d22-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618405823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405823, "uuid": "fe251a62-007f-49d0-8d5b-f639af62fd23", "comment": "Malware payload", "value": "2706054d1eaabdce53d6f94f112c740c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405823, "uuid": "ce29164d-6050-499a-9f69-826cd4d09524", "comment": "Malware payload", "value": "e8ea3a64b3acb02f6096b066936cabb7c9f8529140cd8a05791840796c17c3ef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405823, "uuid": "967fa8dc-f02a-4aa4-8775-b515bcf81db2", "comment": "Malware payload", "value": "acd3d0aa540089f509531ffc3f0b6ccb564ecf82", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405823, "uuid": "1bc31ecb-6d1d-4f6f-8044-f8d655bcf251", "comment": "Malware payload", "value": "c159cc68a5855a7be2aeb00e4ea1448a8ab257aa3e38ad5ced787b9a5da7084978e484580d5a39970e2f3ce87c6e3dae", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405823, "uuid": "29f41e6c-f8f0-41cd-aba1-b6efa255d77e", "value": "F4F4339B4F55EFE16ECA210B5AE1249CF2EC567173942E7909A801EC84184D37ACFEC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405823, "uuid": "5fa2ce16-1f09-4122-b537-6f8c2ffb3319", "value": "12288:JPFLKIF9g1EWwDiyGARf4pVTSnH1ybBCWaHrZcDy3hMmh5Rf2un2STjcyoBp63B1:JPFFgeWwmyGAReVWnHo1aLC23h3/pTog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618405823, "uuid": "3a04c628-04bc-4e28-91f9-fa670ba2ec54", "value": 765254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618405823, "uuid": "6c2eb0ac-a78d-49a6-8d7a-bced7b762b6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405823, "uuid": "e04487bd-47dc-4dfb-953f-91dadfbdd1dc", "value": "GS_ PO NO.1862021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521fa932-9cf2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618385013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385013, "uuid": "74cfc07b-bebb-4508-a154-80ae20b2800f", "comment": "Malware payload (AgentTesla)", "value": "48d3dc043c3aedd3b1d604ddac332a3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385013, "uuid": "fed69a15-d941-4de1-9b92-67e7d014456d", "comment": "Malware payload (AgentTesla)", "value": "e90e22047bc2a6687db8ec8f97f86e03f21d6a236cec9a15219f1464c8fa7546", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385013, "uuid": "1ef42ffc-7309-4aee-b971-d641b6d198c6", "comment": "Malware payload (AgentTesla)", "value": "eec3f1e0e609285d7fe59be8fe842d9aafe385aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618385013, "uuid": "256fd160-3dfa-4dbc-95eb-fc9f8eb8b952", "comment": "Malware payload (AgentTesla)", "value": "40be4ec73a6f0eefc9398441d499b2fe45c7bf7ebae7baa25ece32c5e5e514df8645ed5d764e39fac7834e3e7ecf62f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385013, "uuid": "4f6e456e-7573-4afa-8e22-52fab0299219", "value": "00A4010D7DD66A5EF4032DF8963FA6F150AD9C258350B31AF81F779CED70A09AA281C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385013, "uuid": "e77027f7-0a8c-45ed-a4d2-f3bc6305eec0", "value": "12288:pRr6jPO6xpJsoXdAhFvX+inqBxCVEoLrvTi9:3GhPCotA7X+4+gNK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618385013, "uuid": "963ea3cf-2017-43c9-97f0-37bbdce8d778", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618385013, "uuid": "14e2f639-28d5-45c2-8cdc-ad288b307a93", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618385013, "uuid": "f886331b-7de5-44ca-a25a-22d6804fc2f4", "value": "presupuesto.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907ebf17-9d3f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418189, "uuid": "7cf3af6b-75be-4d5d-90d5-2c9afc80917f", "comment": "Malware payload", "value": "fc9f9a24b4a9b028a7c6e62678ba6330", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418189, "uuid": "97221aba-3dd2-41b8-83cf-564c2676c8a1", "comment": "Malware payload", "value": "e9b4a6087923d109eed56a82b06504c2c25ce028530ce683b7ea9c6a3818d215", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418189, "uuid": "cf0f6e96-2bc4-4da7-b6c5-b84eff4a3fc6", "comment": "Malware payload", "value": "279f7d18edb1c59666760316b97183a672a9e1d6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418189, "uuid": "29586f81-a161-43a6-a358-54ccab0d3c30", "comment": "Malware payload", "value": "40c4438c75c2c22289951d35f7fe855e8d416c23471be979fdeb39fa74e6de8ccd355c06237d00110c9b2ede088a00b0", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418189, "uuid": "8888b467-8ad6-484a-b23a-af93cd563c8a", "value": "D5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418189, "uuid": "4723f0a5-f779-498e-9de4-f76701c79fde", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418189, "uuid": "015c9229-0040-4b65-a036-24018a399d34", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418189, "uuid": "e72c5485-9721-4ec0-ae83-d2d72d50faef", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418189, "uuid": "78bb8583-c164-4072-84d4-7f4b9e771201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418189, "uuid": "3e1d8b77-2e25-4c28-b112-33dbe19dca6f", "value": "e9b4a6087923d109eed56a82b06504c2c25ce028530ce683b7ea9c6a3818d215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fee42f-9d76-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618441687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441687, "uuid": "c3e774b8-78ba-4f9b-8203-f1dd93754202", "comment": "Malware payload", "value": "6aec97ed3ed1ce67e82a451378db5ca1", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441687, "uuid": "20616427-2af4-42ca-8c45-c4a5b47570a1", "comment": "Malware payload", "value": "eadfee9c398d1f5333326b1ac17c1328ece126092c74809769be4c7febb437a8", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441687, "uuid": "c41b481b-e7b6-42e7-a9dd-5cb142e4b9d2", "comment": "Malware payload", "value": "77a060571448a60a215a3a2a3c77bf0b5698de77", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441687, "uuid": "2c6be826-15cf-4dcd-aaf2-5f29229afff0", "comment": "Malware payload", "value": "23aa778464a80921ab1fb53a8f546c4f397b266e65cecd9592baf2828447237385520e54b4eeb5376b4b7d09c582745b", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441687, "uuid": "dec7be77-55b7-49fb-b5db-711f1456f1bf", "value": "90F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441687, "uuid": "06c94ef9-a27e-4700-8bec-8ff18a5b69a5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441687, "uuid": "003d4d9c-142c-48b1-b959-0be9537d2f83", "value": "3072:4lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:4lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618441687, "uuid": "36e85db1-bc04-4b3d-97a3-94343499c5a3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618441687, "uuid": "e6fb492d-30f9-4d2d-880c-241056e62416", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441687, "uuid": "035c5f57-e04a-4239-a7f6-365c3fb83f46", "value": "eadfee9c398d1f5333326b1ac17c1328ece126092c74809769be4c7febb437a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efd1138-9d66-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1618434964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434964, "uuid": "34182ad8-534f-4eca-a4ac-22895aa46d20", "comment": "Malware payload (Matiex)", "value": "e694ef2f814b0dc81b4ffa01f4ada0a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434964, "uuid": "1e185cd7-ef84-44cb-b9bf-d18f52bb8f21", "comment": "Malware payload (Matiex)", "value": "eb247859bfc4c7c78158d54ccb73d4a6b3f3972f7028f9234a9e97b1410e4ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434964, "uuid": "cd61574f-e8b1-4ccc-aaa7-bd8aedeee008", "comment": "Malware payload (Matiex)", "value": "c0d035a791244fde68e8dc40fb7c21a03f7d2dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434964, "uuid": "2a59f1c2-14fb-4bc3-8061-fc68742327d6", "comment": "Malware payload (Matiex)", "value": "155d9abb95ad1d86707dcf6c9907f59e1d0e56f142106d0e29add56007d2d892642ccc7fe9bbdc51530c1717aa594eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434964, "uuid": "d489ea28-1e75-4eb2-9978-3616122f1058", "value": "C615AD516BD55F04E33A8F3348A7A020CFF9E4473E56EB8B1ED829C914B9F258561E0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434964, "uuid": "e8b48cd9-d747-45b4-a9a1-023e8fae9b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434964, "uuid": "77deae22-0d44-460c-91f1-028a187515ed", "value": "24576:A+oixN80vUqOaal6xFshVwrenr3ynz6nd:FxNIaVSvwIQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618434964, "uuid": "5f69a1d6-e8f2-4941-ba95-c35e15d57ca2", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618434964, "uuid": "cab59ee9-f2b6-4dbc-8348-ee150dba59c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434964, "uuid": "c827ca97-a54e-4e3d-8bff-7de1ee5cc95c", "value": "NEW REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60948022-9d56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618427987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427987, "uuid": "3d7d6ada-7776-4481-b6b6-f922ab37c526", "comment": "Malware payload", "value": "3fff5ba5d688b381fb582f5dd8da567f", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427987, "uuid": "a36c07f6-32d4-4945-9a6c-150b8a6ae268", "comment": "Malware payload", "value": "ee852e9f8a5903826bd197ac0099943a807cc62cfe4d5bafdc7c5591bf0d548c", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427987, "uuid": "85e784c5-c9d5-44fa-9513-031d00c60076", "comment": "Malware payload", "value": "8add63d997d2ddae4f3e05491ccdb9363a3dc240", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427987, "uuid": "3da1e7dd-553b-4c9a-9119-fe82fbc68946", "comment": "Malware payload", "value": "30270a8ad10f6a7954e8ad4790d8429a50e4e20734195a6ab6604cd03dbee89560eef94383b345a0f858f87a4e5c83fe", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427987, "uuid": "116a18de-63fd-4521-8729-58c41c84e462", "value": "96249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427987, "uuid": "a0acd3a8-d587-421c-b351-0bcda22fcd1d", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427987, "uuid": "2daa7372-a764-4840-935f-3491c1d7105b", "value": "3072:A0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:7pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618427987, "uuid": "e340a7cc-7797-4249-877e-23044a77e273", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618427987, "uuid": "cc236e4e-d3fc-4157-910c-580dfc8c72c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427987, "uuid": "efc4ec2c-8092-4da7-98ec-4123fee3360e", "value": "ee852e9f8a5903826bd197ac0099943a807cc62cfe4d5bafdc7c5591bf0d548c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c02af4-9d6a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618436443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436443, "uuid": "8b2f7e4b-ed00-414d-9df4-58fe6a95be49", "comment": "Malware payload", "value": "1f7bf9255775a0ff6c5a1f9d6ab249fc", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436443, "uuid": "20a95b5c-d4bf-4385-822a-fa35cde5612a", "comment": "Malware payload", "value": "ef35fa87b7168a06cabbcaf56351dd99e9435763f5414bf5d015899462220eb0", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436443, "uuid": "a1927196-a37b-4304-ae9d-c205b50198a3", "comment": "Malware payload", "value": "d92ec1acb6d76323ab36e3f5937ca5b949ddc7d8", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618436443, "uuid": "d86dd9b3-2403-4c5a-a886-55239178cb93", "comment": "Malware payload", "value": "d92dc024b20229bef0860f0d04030ddb051bafa8a43578d1b9583bc0fd13bc64eb679982c380d0863c27b74e11bfcee5", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436443, "uuid": "ad0b00f9-0c5d-4726-8793-df4a694fc78f", "value": "9EF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436443, "uuid": "90438a49-1376-4d57-aaf2-304e897dbe82", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436443, "uuid": "f16e2751-61b0-4ab6-a41c-dd598bb2c66e", "value": "3072:Blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618436443, "uuid": "2fd323f6-70b6-4831-bced-8e2869cbd0bf", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618436443, "uuid": "d2ff3cf7-2826-4c4c-b173-08016e6dcf69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618436443, "uuid": "25cbce45-3cfd-4e63-a3c7-553cd96b4d3a", "value": "ef35fa87b7168a06cabbcaf56351dd99e9435763f5414bf5d015899462220eb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869428c9-9d67-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618435352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435352, "uuid": "102ff0eb-276e-44bb-9eca-320537268e43", "comment": "Malware payload", "value": "74173f7248daa8224741b91f916a7cad", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435352, "uuid": "9460decb-ea9c-4b30-a6e2-13cf13797aab", "comment": "Malware payload", "value": "ef459384eb0295597082e88b9879640c7a4d26bca94b643469a75c2ab53e96d1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435352, "uuid": "9b922bdd-517c-466d-9369-87e393eaa415", "comment": "Malware payload", "value": "16f3b18b5d6b9c252e6a3231c094f38631124ab5", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618435352, "uuid": "a707159b-9b65-49b4-a869-f97346853d1c", "comment": "Malware payload", "value": "afe81e3c4f957c26abafc417ab9ce2ec6f9087a40e76887c4b5f438a08a4b7ffcca52013ef82dbf7a97a18166b57ea42", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435352, "uuid": "c157bf3e-cc26-4718-8646-2e1730289868", "value": "58F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435352, "uuid": "c852114d-9066-4e1c-8090-5e1b444c42ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435352, "uuid": "e492ed82-6c7e-4575-85bf-a1504a26dcd0", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618435352, "uuid": "d99263f1-f283-4d4e-94fa-7a7dfb6579c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618435352, "uuid": "41b30ee2-149c-4973-ae35-ed052e2a536a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618435352, "uuid": "653b9e97-ec2f-46fc-8807-419538b976ec", "value": "ef459384eb0295597082e88b9879640c7a4d26bca94b643469a75c2ab53e96d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dba8ec9-9d5f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431714, "uuid": "dfa31840-58a2-4b06-961e-952b9da49ba1", "comment": "Malware payload", "value": "dcf7d0d018fdc80ff423243db3fe7cb8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431714, "uuid": "5b394025-42c2-499a-a583-a882d9d94eea", "comment": "Malware payload", "value": "ef8c1897aafdf24a948b597e6e428ae4767ba1d0e694b5b7c6658e25064399d5", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431714, "uuid": "634ea1b0-8361-4cb6-8905-47c80078b199", "comment": "Malware payload", "value": "7b6e1cbd3923c2522c2e899d348a968288fa2639", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431714, "uuid": "ebf15cf6-5c4a-4c92-98d4-b4bf0aadd46f", "comment": "Malware payload", "value": "23c5aa3f8cfb000aa21b518dd5bb9acbf54f2f61556e54204fac508d5e252ba4786b942e37efc7c64dfe660051c90ddd", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431714, "uuid": "49d838f6-b8b9-4831-a44f-3a153cc9624b", "value": "B0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431714, "uuid": "2dcb06ec-3649-4241-a6e9-b2b101700ced", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431714, "uuid": "ab0c2af0-acb5-4c9f-b88e-879224a2fcc8", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431714, "uuid": "d4ad73ec-4dfc-427a-af74-78bc282af567", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431714, "uuid": "a0d5d627-3b78-47c9-99cf-946d2662b02f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431714, "uuid": "11a947fb-5c19-46f2-90eb-27b710833549", "value": "ef8c1897aafdf24a948b597e6e428ae4767ba1d0e694b5b7c6658e25064399d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df620ee9-9d47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618421758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421758, "uuid": "ede00f98-4343-44b3-abd8-fffa566b9e7d", "comment": "Malware payload", "value": "f1559157acf568fa444ceb97b7f82801", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421758, "uuid": "fbc0d7ea-508c-49b1-a339-416e235ebc98", "comment": "Malware payload", "value": "efb9b341d0aee284a7e1f386a74ff75ee290c076e004a42d52aa7fac22e9172d", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421758, "uuid": "10506e8b-6790-4ba7-a792-96bd60ddfd50", "comment": "Malware payload", "value": "898d66ed67218d7e240a1f229507436c6abebef8", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618421758, "uuid": "9ddb5be4-3909-4bc3-b327-1851a0c95d7a", "comment": "Malware payload", "value": "24c7849ffeaf8567ec4117b1407f157fb06f03e34fda0094f2277cbf57cfd4156ae60010a33161b0cd7e52c0aeeb3801", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421758, "uuid": "9be51540-80bc-4a25-93a0-c333f3225a7a", "value": "43249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421758, "uuid": "39721875-df4a-4647-b66f-4179e1b35211", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421758, "uuid": "a6095146-6166-4e0e-bdaf-76d98ad684b3", "value": "3072:+0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:dpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618421758, "uuid": "242c218e-959c-46f2-8e18-5cad4a06fa79", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618421758, "uuid": "cbaec53f-2d1b-417e-ad8e-01dc82ef9aa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618421758, "uuid": "46bf94fb-e21f-4a8a-a78b-df9bfb4eb7ca", "value": "efb9b341d0aee284a7e1f386a74ff75ee290c076e004a42d52aa7fac22e9172d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faecd8b-9d53-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426644, "uuid": "2d31e5c7-f821-4b1a-a41d-1fad2f00e45f", "comment": "Malware payload", "value": "10d3b7c46af9b64400eafe4f7354e444", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426644, "uuid": "25bde634-b7f5-4ba3-a416-09ecc57e2536", "comment": "Malware payload", "value": "f015b1728f69059e38bd1058cd594471e94f93129383c4732fed88873a2e56b2", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426644, "uuid": "0c5b1222-a51c-4209-92a8-6e9b4a6c4353", "comment": "Malware payload", "value": "0c19288e934da124dd4cefe4b0734f6d8e29e6e2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426644, "uuid": "14467eec-3a98-49cc-9ced-124b8d654251", "comment": "Malware payload", "value": "d7514ad0d9b098b98f1759e9abd4d26f43f5e0a0b2f6a6bda104bf72723e03395c159b46e5394b8be803e5705f0ccb28", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426644, "uuid": "2d038922-0829-4c0a-8749-7596231333ee", "value": "8FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426644, "uuid": "a7ce7c7a-f648-480b-98f7-4a90dd77e4cc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426644, "uuid": "531034f2-874b-409b-a200-6acaf4e52adf", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426644, "uuid": "21cb215e-d92e-49d8-a57f-5c538503d717", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426644, "uuid": "3cc7928f-3be3-4905-95fb-d37c8f1d0a13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426644, "uuid": "d05f8b43-9fde-410f-8063-b8ed8802690e", "value": "f015b1728f69059e38bd1058cd594471e94f93129383c4732fed88873a2e56b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd710354-9d50-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425673, "uuid": "02753bf5-0de4-4b68-a4bb-3d022441b94a", "comment": "Malware payload", "value": "141db017f6970d9dd2e9448eff0f44f4", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425673, "uuid": "93b23616-6f77-40eb-ac59-cd293930b915", "comment": "Malware payload", "value": "f121f7aca906342a171451afabcfac5ccef8465dbd1c2b2bb324ae1002f1c328", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425673, "uuid": "147f04e5-db4c-4ace-878f-ed0fe48fcb38", "comment": "Malware payload", "value": "4c6307dcc9f556173d32bb40da182fede0c01299", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425673, "uuid": "a6c7e5db-a53a-49ed-b54f-9b3795a6421b", "comment": "Malware payload", "value": "00cb75c589b494f57874a087b5d9fdfe55b77358d43a8cec7d0ccfe629ddeb212f69d21fffa57956f1e075fadaee3862", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425673, "uuid": "48eb6c3e-bff9-4024-b0d2-2507564a28e4", "value": "83249D8DCBB6D199F6E3EAF00082A36250A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425673, "uuid": "0f23af94-6055-40af-8f76-081b3c9af981", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425673, "uuid": "c8f97afb-9276-4a8f-bdc8-0fd5748b1d9f", "value": "3072:90DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:gpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425673, "uuid": "ec7b4352-d904-4047-902b-0b20fdc18858", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425673, "uuid": "d4033854-57b5-4d7d-bda7-670f39b277c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425673, "uuid": "71c86710-53b7-416b-880a-0f1982e3eab1", "value": "f121f7aca906342a171451afabcfac5ccef8465dbd1c2b2bb324ae1002f1c328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173bc3ea-9d75-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618441179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441179, "uuid": "8eac4d54-da6c-4f95-85f1-d26f7cd92d0a", "comment": "Malware payload", "value": "bc56a36467f2035d7b4afbe9271d9524", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441179, "uuid": "238b9efc-cfce-4d13-82e8-4a09dd78349a", "comment": "Malware payload", "value": "f1b593a1668b4c02bf5135761afb01fd5af36b79b3bb074fc8c8436897a6ac77", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441179, "uuid": "977076f6-e395-4508-b7e3-3da5c1f86924", "comment": "Malware payload", "value": "6c8f18c9a173ccf2c1abf5c91d4161dc8c39633c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441179, "uuid": "3d93ed62-c1fc-478c-9554-4cbe80e74434", "comment": "Malware payload", "value": "23cb21d73a62659f93b9e8c0d7a61910f9c98b2ac90a8f786b212e695e06e7df1b948dbcc9b75a1c1b4a4492df5b632c", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441179, "uuid": "8d2b8f13-ca91-4bbc-b009-4e17958f3ff8", "value": "3E249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441179, "uuid": "d755a1df-4ba2-4040-9c5c-fc940c7a61c2", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441179, "uuid": "729bf82c-ae85-4502-9505-4b201f0d0fe6", "value": "3072:a0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:5pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618441179, "uuid": "dc4782ff-e033-4fa0-8738-275110983c2f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618441179, "uuid": "f2db0483-f03d-4493-8f1b-afbdcdf65c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441179, "uuid": "8aef7728-e459-48b6-98e5-713e4693182b", "value": "f1b593a1668b4c02bf5135761afb01fd5af36b79b3bb074fc8c8436897a6ac77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f07184f-9d61-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618432602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432602, "uuid": "2c547231-2bfa-4d83-be75-1fe735d41d6d", "comment": "Malware payload (SnakeKeylogger)", "value": "b2ea5311684f2543466d7946f94c08ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432602, "uuid": "14475e0e-362f-4425-91fc-fea0733062c5", "comment": "Malware payload (SnakeKeylogger)", "value": "f27c6d23143bb1c0ea77515c806ee7d75889c31262c7c26a5868989fef41e466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432602, "uuid": "9d532af6-f316-40d2-ba41-9d6f105a449f", "comment": "Malware payload (SnakeKeylogger)", "value": "ab08253218a377386c1d0f4bed3186e457488ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618432602, "uuid": "856304e2-bb82-4dc4-8cb8-4f73b551d90c", "comment": "Malware payload (SnakeKeylogger)", "value": "956f30c4e115d1b36033a18093a1fdae3ce4529e15254dfc305dc3d3b762b09d491a5f4dfd97da39f911c745fbd203b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432602, "uuid": "362546ee-8499-477a-877a-25498db4715d", "value": "7754E08A5506891DEE571D3019ADB7340B9BAFD71A9DCA89FC4B357BCEF33052A02321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432602, "uuid": "81623d2e-701c-4e58-bc57-30282e01e802", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432602, "uuid": "5e20a832-ae86-4e0d-aae6-897d2638b6cd", "value": "6144:iHaeoQ6FWtvzv1dWeWUCijkpllb/oIwqApZ5lGgO:iH4QWovzv1dWeWUD8Lb/5bRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618432602, "uuid": "e5aa3e8b-bac8-41f0-a540-7658d68cc92c", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618432602, "uuid": "38755172-645f-4e06-880b-3c0315f7c5f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618432602, "uuid": "e0852b81-235e-457a-b9a9-91843064814b", "value": "IMG_785_08_87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb96672-9d71-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618439522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439522, "uuid": "ad3a1ef3-19f8-42b1-adc7-20d66db13602", "comment": "Malware payload", "value": "a2e4d68ce1fd5dedad5a713a318d5d62", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439522, "uuid": "3d501ec5-982f-4f58-9e18-90dc65322dea", "comment": "Malware payload", "value": "f2912eaac3478888d99dd2839b3294e0fbd5f5bbdbd9da1f74d6a5196ad5c039", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439522, "uuid": "2c1f31be-fc29-4968-97bf-9eb4413b0fbf", "comment": "Malware payload", "value": "e57187f13b508abc37158a5e486f910bb08f3425", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618439522, "uuid": "1e14eed1-d077-4a9d-94ec-f3c8fe9c3626", "comment": "Malware payload", "value": "f50281157c476cd64aaf7e6e83d24d352bd860a65fb751d7b08ab86c79660ccd93c6317fc03e0425a245c16bc586cbd7", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439522, "uuid": "4b881e99-3e29-4545-9170-0993c2fd7058", "value": "DE249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439522, "uuid": "1a12bc61-cd52-44f2-b24f-162e30c25310", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439522, "uuid": "84188ffd-5fff-4901-b264-573cc5ff2e32", "value": "3072:V0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:4pepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618439522, "uuid": "f6e9cd9b-818f-42ca-81a1-9b4b3e2e10fe", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618439522, "uuid": "f6a64768-7194-4d82-b730-5eac50a14852", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618439522, "uuid": "25fa39e3-b580-48fe-9517-52ffdba8fd19", "value": "f2912eaac3478888d99dd2839b3294e0fbd5f5bbdbd9da1f74d6a5196ad5c039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5633cab4-9d42-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618419380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419380, "uuid": "e4f20de4-cb1d-4f21-b79d-c6aebd819372", "comment": "Malware payload (AgentTesla)", "value": "cd9937bc9b32cbcd0d7b2968958a4ac0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419380, "uuid": "9eb9f689-cc10-43bf-89ad-1afef9cf3dc8", "comment": "Malware payload (AgentTesla)", "value": "f3ce6962e0e3ac2cb3384df02bf0e4851362eeceae101d92f26ba641e4846e20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419380, "uuid": "78099c21-ff44-4290-918c-8f73f2fb9377", "comment": "Malware payload (AgentTesla)", "value": "42594e6a22a9669756f525a5b54969f601eb376c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419380, "uuid": "72136fc8-a5b3-4573-8088-e2498dd130fd", "comment": "Malware payload (AgentTesla)", "value": "40d6a8df73efcc6cbb1dd2cf4d681e72848dd4916f81810060d99c8b6f82297db34ade82049c8da00299bb249d28dc75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419380, "uuid": "4c908557-adf6-4632-a817-b8b4875ef07c", "value": "AF455A16A381D584F22D6D72CC61F6F04796FD2BDE0AEA0709C93EC270BFA56463A543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419380, "uuid": "3988c68c-dd88-4c39-9033-588d04a4ed99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419380, "uuid": "e9ba63c3-277b-4aeb-85a3-708e9fce3392", "value": "24576:Zm76+nwUWxTt/g/mm11NyrYV9kbOw+9eBhPYQ9SdOl9Jaq+knmetsqXtZ102mHrA:Zm76+nwUWxTt/g/mm11NyrYV9kbOw+9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419380, "uuid": "5799828e-94b2-464e-967c-51c8075d56f2", "value": 1212928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419380, "uuid": "a9962a73-0240-463d-bab5-4b5c2f85da56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419380, "uuid": "b553d478-ba4c-490e-9f72-82b7859879da", "value": "2009025C##.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948331cc-9d51-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425927, "uuid": "04cf6b4b-83f8-4ace-8c90-c9387663c338", "comment": "Malware payload", "value": "70a86b66daa9473ea709c1ac3a3caede", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425927, "uuid": "0021bde6-e015-423e-9946-328935b983c6", "comment": "Malware payload", "value": "f40a3edeb3b42a4743001804508c1fc8f1a757f93f83de578d471a0af59488fb", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425927, "uuid": "e7a0d783-c5a5-47bd-94ed-54c6a2dd8eb0", "comment": "Malware payload", "value": "51d7537a13e26ffc55067fd6420465e004d4b74c", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425927, "uuid": "eae7d441-5ba7-4716-b3ba-77b0861e310d", "comment": "Malware payload", "value": "7e3fd4bef3a3e3f4ce59dae5a453608336c82ea20c1cf6e636e98c838b6ecbb8995202b47a21183447f9c5b9b4553d89", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425927, "uuid": "d5bcd134-0e71-4d97-838c-6250c34d0e93", "value": "D9249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425927, "uuid": "850a1249-80e7-493e-b30e-194593fc1dbf", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425927, "uuid": "a2d6402d-2d63-4abd-b26d-5d3a5c8f3684", "value": "3072:80DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:HpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425927, "uuid": "cd1ae8a7-81ed-4c23-aaa0-77361c40425d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425927, "uuid": "3eb09431-a30b-4704-818e-91ccf090a186", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425927, "uuid": "bf8dc873-e44b-4c65-84b8-d475c05c24a1", "value": "f40a3edeb3b42a4743001804508c1fc8f1a757f93f83de578d471a0af59488fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a97e4da-9d43-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618419683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419683, "uuid": "05a41f78-349e-45e5-b9e7-30d6e770325c", "comment": "Malware payload", "value": "5724a6f518e91beff5621846f462d53a", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419683, "uuid": "0da485db-0fa4-4afc-8869-4f6f557e5d1a", "comment": "Malware payload", "value": "f4e1a14c09f19397057cdc7a8bd6804d6eba60fe28f3f688418186d179c5e569", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419683, "uuid": "00074c32-8704-4dd1-8654-05591f9748fd", "comment": "Malware payload", "value": "2f8f2c3a19d2d8f9c7482e15941d9b156dd0e2cb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618419683, "uuid": "2e4a7517-4da7-4ad4-9953-87da379038fe", "comment": "Malware payload", "value": "f7e35b7ac9eb0e45d7406d148da3c5f1d7ff385c376a0a64925db88db70792d1e85bd01cc6b5283c53e52f7ec2d2288d", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419683, "uuid": "a7c55f58-3a25-4700-b04a-fb9211c1f2f7", "value": "16249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419683, "uuid": "c1121c0d-35ab-4d24-912e-e0d24f49b249", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419683, "uuid": "f8f8f104-ebe3-4d29-9ef0-ce39a2914085", "value": "3072:d0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ApepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618419683, "uuid": "72af852c-0ef5-4254-aa47-fde61cd88e73", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618419683, "uuid": "c7a4541b-a287-4037-93ff-120fc0d1133b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618419683, "uuid": "83200f5c-0ff6-4e00-8959-1a6393459696", "value": "f4e1a14c09f19397057cdc7a8bd6804d6eba60fe28f3f688418186d179c5e569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56822356-9d5b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430118, "uuid": "b54aaddb-6e2b-435b-8e18-d80dbc50cb1e", "comment": "Malware payload", "value": "94cbc01e8882600fe79e3154ccced5b0", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430118, "uuid": "5bc85c63-4eb9-48f0-93b1-f4767e32f359", "comment": "Malware payload", "value": "f5e559ae22b1b2412435a659ed1e43a873334a8e20c36eca8ede331ccebc7012", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430118, "uuid": "12fdfee8-57b9-4c21-bd25-6916320c9997", "comment": "Malware payload", "value": "d7471f8d98515400cf925374b7fff6ef1cfb75c2", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430118, "uuid": "6e2ecbd1-51ad-4a5f-9642-b002abaa94cc", "comment": "Malware payload", "value": "09d4da067c00ba7614e25e5510ed6fbde2d0c6bcb47f3f3d10f097d24dc78dd616b792be6d968087716b36f4083971a6", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430118, "uuid": "a7a16b6e-1418-415a-9182-f20078661ea7", "value": "FF249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430118, "uuid": "e7767454-ebd1-423b-9168-1af28321d40c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430118, "uuid": "9720cf9d-4f5a-4df5-8658-1766724c5733", "value": "3072:d0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ApepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430118, "uuid": "de2909ba-597c-441f-8d88-67a938c7784d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430118, "uuid": "52203c9b-c588-4cb0-a21f-cf5185146607", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430118, "uuid": "85d3160a-0d2d-4bfa-b06f-24a0a90fa1e2", "value": "f5e559ae22b1b2412435a659ed1e43a873334a8e20c36eca8ede331ccebc7012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82500953-9d78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618442647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442647, "uuid": "9c30fd59-5ef4-4fc3-bc4e-211a0c3930ac", "comment": "Malware payload", "value": "97e29af97d97b88a59c272075843aa54", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442647, "uuid": "cfe9f174-34c8-423e-8ee4-289909ba870f", "comment": "Malware payload", "value": "f6996f43e16d8b723179d4aadf2864535d5ae8b42086f391b52bf0d447605096", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442647, "uuid": "883cdafa-816e-4ff4-aff6-17a0aa85e9ec", "comment": "Malware payload", "value": "d399884c93b4d2c804d7b957a912ec59aaac5875", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618442647, "uuid": "a0f18269-9e0e-428f-9687-e071482a6cc4", "comment": "Malware payload", "value": "253b0e2ff2dc67767b415785139ce7808cdf6aecf425b86c96f428149f0ae05946928e269c05bf4dc19fb86df4f528f4", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442647, "uuid": "ca84b1d6-3a70-42d3-95f5-1abe2935a2f8", "value": "F9249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442647, "uuid": "aa833cae-e236-4e87-bc88-73ff4abcf42e", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442647, "uuid": "afff51dd-9ddd-4e79-b2d2-5d947b11732f", "value": "3072:d0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:ApepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618442647, "uuid": "04ea6aa4-e6ed-480d-b929-d3439adf1ea2", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618442647, "uuid": "92e9a641-66c0-4931-a29f-c7eaa762b39a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618442647, "uuid": "165b2be9-dd4d-436f-8537-20c8f229a29f", "value": "f6996f43e16d8b723179d4aadf2864535d5ae8b42086f391b52bf0d447605096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e23280-9d4d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424314, "uuid": "16b1cc0d-9d3c-4886-909a-8e63a7fa43e6", "comment": "Malware payload", "value": "162bde9adc5a5f4fa44b2431e2e2efdd", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424314, "uuid": "fbd846d6-3c19-4809-8d16-b2b2e748af34", "comment": "Malware payload", "value": "f6c1acbe88f19480588c3f05968606dc93cf327b7e92614d0234dbd9ea96bdaa", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424314, "uuid": "1023428f-4d58-4435-9d52-9d36aa874246", "comment": "Malware payload", "value": "1e3c7baef7d305b8d4f912c8f877a3b429937d9b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424314, "uuid": "7e58a5c8-3308-40da-b70b-8d756e8ae280", "comment": "Malware payload", "value": "56f03773ff017a63abfefe8cd039a711e89b714efb97d9c6fdb776eda5a30169a138721fc71b42a1ce18a2989d7f892a", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424314, "uuid": "96fa5415-c2b4-4098-8a99-5cbeb1b8e489", "value": "00F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424314, "uuid": "cfb9f7d3-ebe9-4093-bb78-da415bfe1a04", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424314, "uuid": "0c9acc04-35f5-4f06-9569-fadb2b01e28f", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424314, "uuid": "8f7d2063-ad41-4429-a87a-c5075147cae4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424314, "uuid": "47237051-5465-42c6-a8c6-3ea366c678f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424314, "uuid": "59ce826f-6cac-4f44-9a3d-ca7f3eb21f81", "value": "f6c1acbe88f19480588c3f05968606dc93cf327b7e92614d0234dbd9ea96bdaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9610b547-9d3c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618416910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416910, "uuid": "4f72adb3-b024-4bf2-9499-7731fa9f6540", "comment": "Malware payload", "value": "53c92658c4f9e21481ccd7d7ca634ce2", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416910, "uuid": "b3dd4dac-058d-4937-aa14-ad184cad2602", "comment": "Malware payload", "value": "f6d1fd54a62a68f9245c7a1197fb71302ccd1539283096dc71866b9c5212ffb6", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416910, "uuid": "480638ac-fb28-4988-a6d1-8ecbd3306920", "comment": "Malware payload", "value": "2306c0889b8ade776f46f86cec237a9e42cc3843", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618416910, "uuid": "12849982-c890-486d-a093-25c6258e5383", "comment": "Malware payload", "value": "19205c4108d3d709b46469f917666776bdcbf94b8ab3768d398e5399288bd8907618089140f2d40dd87d0de0587364a8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416910, "uuid": "e404db66-0931-4dbe-ba2c-921787666dd9", "value": "20F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416910, "uuid": "1bc87311-596c-4b3a-8f79-67799a1e47f9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416910, "uuid": "c1249a5d-71a2-4536-af66-6238951c4f97", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618416910, "uuid": "81c1bec3-757e-41df-8fab-9153d80514cb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618416910, "uuid": "ee931ae3-124b-4dc3-a7fa-66f74f10c555", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618416910, "uuid": "d713d72c-b387-4cfc-9376-fc7172b09250", "value": "f6d1fd54a62a68f9245c7a1197fb71302ccd1539283096dc71866b9c5212ffb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31faa69-9d65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618434622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434622, "uuid": "202629dd-c65c-4fbe-93e2-e5c31e082494", "comment": "Malware payload", "value": "71ced8575ca35ef85fb9c4479baab2ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434622, "uuid": "8a09f25c-f637-41f4-9a28-72014bb5343b", "comment": "Malware payload", "value": "f951e36b161b719e163bd8b12cc75f8789692ddaaf0725ecba33232858e12b8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434622, "uuid": "afc0de5b-7906-4fda-abd5-1f2768dfb97b", "comment": "Malware payload", "value": "a8595ac7193908e987db05b13c13b113c9baa555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618434622, "uuid": "f65f81c0-84ec-4c8a-aac9-9cfc7abd25f8", "comment": "Malware payload", "value": "b26dccd37982403cec7aede8a799f933d9b842887b7fd52e17c5c403702784020d7fac05f0bee087148b5223c4feaeed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434622, "uuid": "886aaef8-bc97-4e71-bba4-9f4543bf92ef", "value": "8F849F64AF931F5BC6D8D1FD40C6D166C9A9FC5DC2B2291A37B2CB86FE00544ED2C286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434622, "uuid": "a9beb13f-48d4-4281-b9ab-ffb8202b5003", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434622, "uuid": "0a96338d-30ed-43e8-a793-59f4afce04d1", "value": "3072:HFd8sbWWQvMAidafeLmCdF/+B8xfHJAjU4HsajDRU6FXaJ:ld8LmAt2LmSdSYHJA/sajDRfFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618434622, "uuid": "faac859c-8641-4104-a0b9-40fc7a41cf71", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618434622, "uuid": "c283ec57-1a41-4c81-8942-c0946661ae56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618434622, "uuid": "9a75e2ce-2999-46b1-ad38-eac7ed6d5e3d", "value": "8L0TFKEH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca72a32-9d72-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618440221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440221, "uuid": "665598b6-0b73-426f-9ccb-44b453ae02d8", "comment": "Malware payload", "value": "b941b06af4e504e8f150acea1874e872", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440221, "uuid": "dc1d6bc9-87a5-4e75-8e26-109a9a6f662b", "comment": "Malware payload", "value": "f9b08cb64373d01e2a8623b56619bc40168287f5bb777714502fed7934346c9a", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440221, "uuid": "4fae7d13-01e2-4ca3-a289-1d354fb449c0", "comment": "Malware payload", "value": "31e4f23480b11fc0f1467c6365cc2ad4f18d0bfb", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440221, "uuid": "2872b644-f20a-4783-9e40-8505d16dd0de", "comment": "Malware payload", "value": "bd5b6828dacd571ead3d78cd7b7367a57fcd6dc5aa34bc9456819a0ff7e9d2cf6fc8ba1e4c3d2bfb3483b2687ad2ca68", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440221, "uuid": "9211931c-d47f-4627-8ddb-6d66ed8b9274", "value": "AB249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440221, "uuid": "d400f5fe-ba72-477a-9c44-1b73ff5c2ab1", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440221, "uuid": "9434a39b-8ceb-445d-98f4-e5803cfe0118", "value": "3072:t0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:wpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618440221, "uuid": "71e8924b-4893-475e-8e48-b7f8971565de", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618440221, "uuid": "fd34de18-8861-4330-a2c5-e333230f8694", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440221, "uuid": "73ec4ac9-cae7-464b-be88-4a8a3b273f86", "value": "f9b08cb64373d01e2a8623b56619bc40168287f5bb777714502fed7934346c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f3987d-9d76-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618441794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441794, "uuid": "3353be5a-b87b-45c0-9f9b-dcc5c746ceb6", "comment": "Malware payload", "value": "a20d83e33f49480351f933bb154115b8", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441794, "uuid": "a7e81eba-d37b-4fd6-9bea-6666efb0b9bb", "comment": "Malware payload", "value": "f9c40c9656bd3ffb4f35ebbe679ca3052f0c3340b18e4aa767461165035bb1c8", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441794, "uuid": "59bcc071-a549-474b-b276-a5dc32b305a2", "comment": "Malware payload", "value": "ab2e418790e5dcb65e90f57471b6958b877df4d6", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441794, "uuid": "60e16194-ed09-476b-99f1-2689628256c7", "comment": "Malware payload", "value": "5d3833b18a01d70157262d5d27d2e899c441a2a7fc3b1efe9ff45f0561319c269e22680e909dd7a67856b483db883535", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441794, "uuid": "4812936f-cb41-4d1c-b49e-4eda92191d4a", "value": "FB249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441794, "uuid": "faf40ebd-0ba5-4632-80b8-98926fa8e8ec", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441794, "uuid": "72471d92-0c7e-46dd-bc39-aad261adce19", "value": "3072:c0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:npepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618441794, "uuid": "9516e556-5b68-420f-b841-2c87114cd4d8", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618441794, "uuid": "549c0132-7646-49bd-8f04-1fa414a38231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441794, "uuid": "6c7e3d4d-cba0-4fbf-90e6-376be4479554", "value": "f9c40c9656bd3ffb4f35ebbe679ca3052f0c3340b18e4aa767461165035bb1c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127253ad-9d5d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618430863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430863, "uuid": "c55a3dc8-d223-4a47-8218-b2c2aea21439", "comment": "Malware payload", "value": "4c9d3db50cd58ec12305d904d2354f00", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430863, "uuid": "b7f2670a-9d44-4939-bd5d-e43dfe3afd10", "comment": "Malware payload", "value": "fa0e9c96ef83963d0ab05d58302b13ac57356aed411562c71ef1812066e8ac97", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430863, "uuid": "5a4a0b2c-30b9-4252-8a4b-964e1d1d94cc", "comment": "Malware payload", "value": "b0a4028da497f94c3d00f0c44a60b40fc369d5bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618430863, "uuid": "f5bc31a9-5d56-4d4d-bdc3-46ddbe25fa5c", "comment": "Malware payload", "value": "55a4bee3819e73734fe68c0b227b22eea059988dec21ba4a2dc55569db846b14bcdaaac7c4d817a62b1d0fbacdb54c5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430863, "uuid": "81ecd516-737d-4cd3-aa8c-1d14dd6d9da1", "value": "A3F3D0B3B6A5DD42DE72073C0EE946461713BC0E2B56C69B7324FB9F7F70580898261A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430863, "uuid": "f487c29c-f119-405b-859d-9d1c06fde8f8", "value": "3072:gk3hOdsylKlgryzc4bNhZFGzE+cL2knAcKKWXQ3kl/GVMfliRx4J2iSAqsaHHhaw:gk3hOdsylKlgryzc4bNhZF+E+W2knAc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618430863, "uuid": "39c62b10-7050-4015-8ed6-b66b875dc601", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618430863, "uuid": "4b81d8b9-4c64-4a51-86ca-75ff283c8bc8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618430863, "uuid": "ebf6ed9d-a165-4959-93d4-3a7a0290dffd", "value": "IMG_50_78_63.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce183c0e-9d52-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618426453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426453, "uuid": "db64995c-522d-435f-b17e-9cdcadb2428e", "comment": "Malware payload", "value": "a59f5edfedb546a3dc0769b1e9981272", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426453, "uuid": "91bc0882-adaa-4ac0-9078-83e75fe3b2ae", "comment": "Malware payload", "value": "fa4758a740bd04ab3f2541cd0a828901067563b560d40f193f1faff90c0d3b76", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426453, "uuid": "88785bcc-a796-4163-814c-7182e57996f8", "comment": "Malware payload", "value": "6858e02d2be34932fc829faa4d796f68e82e4d37", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618426453, "uuid": "6a4acc98-f962-40b0-8761-c011165eebe4", "comment": "Malware payload", "value": "3c740168f1d94d53fa8e54962fda3058efe71f7d88a4ca29f2082b846a5db2aa10ab4f32e7208485ab6b132b5da99836", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426453, "uuid": "7575ba4b-4c13-453f-b0f5-5aa645b55d1b", "value": "C5249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426453, "uuid": "bd52a21a-cf86-4217-aaec-1dc14bbbc51a", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426453, "uuid": "58a8ae93-12f4-4e20-ac01-097b4a04a15f", "value": "3072:80DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:HpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618426453, "uuid": "d66746cb-5e1d-417d-ac8a-ff4f6f61b3cf", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618426453, "uuid": "8eea37d6-100d-4923-96c9-092b8eefcbc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618426453, "uuid": "701f86f1-b97c-4bd2-94c6-a9b0e24af389", "value": "fa4758a740bd04ab3f2541cd0a828901067563b560d40f193f1faff90c0d3b76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74420084-9d4f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618425014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425014, "uuid": "abdd0ba4-0944-4bc0-808d-d2e180795371", "comment": "Malware payload", "value": "54bed27387b134cfa7dbd17699b13165", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425014, "uuid": "691d9b91-caa7-42f3-81e7-5f40b8442385", "comment": "Malware payload", "value": "fb17b85aa2aeaa59cb6db3e1c6eb68f83a570b5de3f10d3b09dd47a4aebdedea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425014, "uuid": "2c2c2778-8b98-4ffd-b130-4018b7ec08f5", "comment": "Malware payload", "value": "ff5f8d180606e4622ed2876bc5f895d3ded6ebcf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618425014, "uuid": "3f57aa18-0f73-4c9b-8cfe-2e9b63b10865", "comment": "Malware payload", "value": "cf444c702a7f9430e23656139b15bd5eabe973f19d70785f5b5a8e4d60b551e5d4e314772619e853250f44645dbd4edb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425014, "uuid": "1b5d516e-ed19-43ca-b770-de63dfce75e1", "value": "AD45BE6663A85F65F07EA7FA50341000A7F5BC13D721EA0E7DD170EE0AB2FA18655B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425014, "uuid": "50336850-bdb7-4210-ac5e-b6aed370eb73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425014, "uuid": "28b93938-a402-4b0f-a963-914aeaa002b1", "value": "24576:4egQ9xslB/4cFRZ1zPsP0U3aDyvkzZ297:Pxsj/42RgP0Uqec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618425014, "uuid": "53040098-8f50-446a-afdd-65f375c0fbcd", "value": 1185280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618425014, "uuid": "05150afe-b69b-445e-8045-69d45de3110f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618425014, "uuid": "eabd80b9-add5-4c4e-ac82-49983c01ce68", "value": "INVOICE pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9deb559f-9cfe-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618390295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390295, "uuid": "225fcc68-4454-462b-b68a-f593185a9598", "comment": "Malware payload (GuLoader)", "value": "ba44ed5dd41e6438b5fbd1edd26e0ec1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390295, "uuid": "0767b09e-30be-4238-88da-c9342efdec2e", "comment": "Malware payload (GuLoader)", "value": "fb1d395c934189b6bec3688d8126c09ca99ef6b53cc4b441f5a6742b7fcfa163", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390295, "uuid": "4536fa36-d9ab-4bda-ad98-5d89590b9957", "comment": "Malware payload (GuLoader)", "value": "ff676159765b4228b62ea6d28859e7564e2af243", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618390295, "uuid": "c6fd0e99-4849-4d78-8e93-695c95449187", "comment": "Malware payload (GuLoader)", "value": "a2411d6e6ac0542e7ae5624363faacfcfd37517d683327cae67fb3f6b5e9bbd2280142ba9b778c5d563288583e004512", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390295, "uuid": "3864fcc0-f8ce-4ea1-8f03-a3fa8679f327", "value": "D093E7B6727DF07DDD4D44FE3BEA12A918603C30EA49D40ED281211D3674A47BA3AB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390295, "uuid": "c3c38fdd-5c83-4823-8f45-c822f29f2aa3", "value": "4ba170b6a3de0ed01456bc01eac94f5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390295, "uuid": "447619e0-44cc-4576-8402-e2e0494b045d", "value": "1536:7k88k+tcpHX82G99mvlvUKfWDx1XmZTAwU+nTyj6QNogEmqdDaNVSmuAwZWbKy3H:ukOArKae68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618390295, "uuid": "dbcd02bd-78ef-4a14-9fd5-66f201c0e91f", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618390295, "uuid": "5dc5de28-0ab3-493c-b69a-11dddbb22ff8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618390295, "uuid": "423b2052-abbf-4195-9c84-171bcc248378", "value": "Faktura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2110ae-9ce4-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618379289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379289, "uuid": "da67fcca-cc9e-461c-bf22-f99550eda976", "comment": "Malware payload (RemcosRAT)", "value": "c9b299d9fc7ce4cc6fc4ecba881f6aa6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379289, "uuid": "02427c55-b61d-4e5e-95f4-995c6af0794d", "comment": "Malware payload (RemcosRAT)", "value": "fba2e1c3892ab5ad870da43781366524acbef4d4c2ee6364f9854d22ecfab826", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379289, "uuid": "e4575098-c6f7-466c-b2ec-7fb67972ff34", "comment": "Malware payload (RemcosRAT)", "value": "48127841118cab84b95e3bbe7775883c8cb5cc7e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618379289, "uuid": "fb164f1a-f046-4167-ae28-7eec6a92707a", "comment": "Malware payload (RemcosRAT)", "value": "a72d96252b948dab26936670059cb2a50e96afc3e31ff78543ab3eb9e9fa9db25288cb4aa809767d2e1deadde458cf73", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379289, "uuid": "e0be26d1-7abf-4b3f-9051-68f76c527eb5", "value": "7C15F12237A86B97E13E563884B1058202F1FD10A677DB1F7DE0B58D26B2B52876371F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379289, "uuid": "38512fca-7c69-4491-9cb5-e42d0e8ec9ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379289, "uuid": "a7d78579-9acc-4cb1-b3cf-6fc00e93183c", "value": "24576:Yqo5hQw7Ga+BqAuN1VZERPUqT4Do5hryR5zl:YXaa+4AAV+RPD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618379289, "uuid": "e3a63860-5ea5-4211-97ec-538079646496", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618379289, "uuid": "de17c822-e362-471b-8997-16d0c6edfa62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618379289, "uuid": "030ea0e8-edae-4a82-859f-6de94a223149", "value": "\u8a02\u55ae\uff082275875577\uff09\u6a23\u672c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cee5e97-9d75-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618441296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441296, "uuid": "99ad240f-0a1c-479b-9b68-f4efd0af7eb4", "comment": "Malware payload", "value": "718797ba8f10f994dbc9e8eb7f7892e3", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441296, "uuid": "3cc0e82f-9ef7-44a8-8b32-40c5cdb33346", "comment": "Malware payload", "value": "fc04d9dd04aa2f8eb3a78cb386088d41081b64bc837170c5c195fa7b42b56b50", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441296, "uuid": "743cbc0f-7ea5-4e00-aa50-ae07c8f3f9bb", "comment": "Malware payload", "value": "4e2634aba15955ea55ba05a9116bfc1f33bff273", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618441296, "uuid": "1c1e5da8-7d62-44ed-bc8d-ebe89de6b3b9", "comment": "Malware payload", "value": "844c3789ea456d66fa1f862048a0b6cbb80ee6044ad1ac4558435d08c9b5f9ec07d3456502b39b7373d10d44330e44eb", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441296, "uuid": "8f397aab-aa00-47c5-8829-58321083228a", "value": "0B249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441296, "uuid": "414212b4-4baa-4976-87da-841421965017", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441296, "uuid": "8d9890a7-b916-4e04-a277-9ed92fb2cd3c", "value": "3072:I0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:DpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618441296, "uuid": "f0dcd640-e41a-49a4-b401-8aedf9cac1e4", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618441296, "uuid": "e03f651a-15ff-4a9d-8bf1-063d0abc604f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618441296, "uuid": "b81a2972-742e-4740-b792-37f72cad35cd", "value": "fc04d9dd04aa2f8eb3a78cb386088d41081b64bc837170c5c195fa7b42b56b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed73484a-9d4d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618424358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424358, "uuid": "7af0ded1-0877-44fc-9eb6-d23d675adda4", "comment": "Malware payload", "value": "446c0d6bc1925b13eb578d54595cb484", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424358, "uuid": "4a8e3292-1735-40d2-9763-eaa62707a72b", "comment": "Malware payload", "value": "fc1b4e3eea665c14b530637de4386f13914fe4a53a6d8b2f9caa4dcf3466aae1", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424358, "uuid": "d38899ed-3f93-46f8-8fea-0343fa9a2df5", "comment": "Malware payload", "value": "a695eb8fbd1fcfb8fe0b42c2f7ff35b956882e85", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618424358, "uuid": "c3ad5ebf-26e8-4a15-8ef6-599eb4983ffe", "comment": "Malware payload", "value": "6e038d08d4edde092c9b32a65461c1723a2780a721aecfcaad9a83e19b49d3f834d62c546a0001fd4f9df9ce1996dca3", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424358, "uuid": "7ace9c26-7197-4024-987a-199b7f716abb", "value": "B9249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424358, "uuid": "33833e30-2873-4eef-945e-86959f261d2d", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424358, "uuid": "73d71383-8952-4f25-9b3f-adf9e60ac864", "value": "3072:k0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:PpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618424358, "uuid": "4641b420-7ef8-4a9f-8d99-22fb92df6720", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618424358, "uuid": "6dee05d6-439f-4b54-b577-6b658b7908e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618424358, "uuid": "7e171d8b-2f1b-4915-8c12-5e617a4f87a2", "value": "fc1b4e3eea665c14b530637de4386f13914fe4a53a6d8b2f9caa4dcf3466aae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee456b2-9cf1-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1618384793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384793, "uuid": "183b71cb-7e37-4730-acdc-ec087e8cc51e", "comment": "Malware payload (ZLoader)", "value": "0bf11ac4cf33ce34e45622e6b2b1b7d6", "object_relation": "md5", "Tag": [ { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384793, "uuid": "6ed54c8d-7aca-4234-a142-449bacbacbc3", "comment": "Malware payload (ZLoader)", "value": "fc385914e030cdc9b178d9c5be1142dcdb58de0eb54b8f2e17323bfad193c1f5", "object_relation": "sha256", "Tag": [ { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384793, "uuid": "31b4a477-e421-4031-93f8-d9bc8639dd59", "comment": "Malware payload (ZLoader)", "value": "1afb8d85937d0f5f8fc6e3f1cdb6f39405826360", "object_relation": "sha1", "Tag": [ { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618384793, "uuid": "ddc402af-46bd-415e-8fee-acb0fed1b35b", "comment": "Malware payload (ZLoader)", "value": "cf42b54b84eb800ccfaa6a863eeb890a593bee3aa16a6adf91f069a35c7b340db3cd389c1a3e305817d14c7998fbdd27", "object_relation": "sha3-384", "Tag": [ { "name": "nut", "colour": "#DA94F3", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384793, "uuid": "e6009378-ce99-472c-8900-bf8f30e171ae", "value": "BAA2BF1DF5A2DE2DCB1292BEE01440F09A0E7062A845FD56A45135A836C3E975BCF2DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384793, "uuid": "44a1ecb6-b85d-4aca-bb46-e5d8851c5e43", "value": "384:TLyUw7OXYa+sPjeqYcaSfVhAPedNk13UlM9zxpGoZZC/fSOXKz:TISXYaJPDYca6hs+k9xWoZZCyo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618384793, "uuid": "b37b7214-367f-4cbe-a73d-90a2404e009b", "value": 22712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618384793, "uuid": "6c914828-a6b9-43fe-9f3e-04be6a595341", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618384793, "uuid": "dbbcdaaf-c722-418a-8ed6-7052d8f3c1c5", "value": "p2649.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d795acd8-9d22-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618405853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405853, "uuid": "8c3948ca-9e7d-4d48-a343-32f2bc936c80", "comment": "Malware payload", "value": "7f9368daa47d3fbe709c158b32d67e3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405853, "uuid": "57b73c18-e84a-4bf1-834d-e61437fcb6a3", "comment": "Malware payload", "value": "fcdfe733ba9767a037b41857182dd5874eb364ff729a5dffce007a04a10d09cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405853, "uuid": "80ec9cf8-fc04-4a21-84b2-b7f3721c92ad", "comment": "Malware payload", "value": "6e2d9a7abfa0440b1a2c72e81e97d58eb3191d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618405853, "uuid": "5f8b56af-c3f6-49e5-9c35-cbf03e3424d4", "comment": "Malware payload", "value": "fa001225c99bd7203deb0f62f37e0e5db362a23aeac449f82f6a10a4f925fd134d93a9f316ad5cbd33bd03dd558610a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405853, "uuid": "91749bcf-d0e6-4786-aecc-850260bc74e1", "value": "630501F90BA88E63DBAE14B9E07111C443F5E2236316FF8C6DE411E960C27925B2665F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405853, "uuid": "b8754617-37ce-4927-a0d9-928360b65237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405853, "uuid": "516b41d6-05c7-49a8-8119-574bc94a8f91", "value": "24576:eTiYhWY4goWweAGAR4VW9H09alCK3hpZHpOBT:CWY4goW4GukWsaAK3vZH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618405853, "uuid": "9c3244fb-93d5-49f2-b636-6b5266f04ca7", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618405853, "uuid": "12aae299-08fb-45cb-ae30-679980096e02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618405853, "uuid": "7d449922-f784-4f4e-b5c0-9b3bc5fa2774", "value": "GS_ PO NO.1862021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bc17a9-9d34-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618413386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618413386, "uuid": "ba524413-bf8b-42b5-91e9-7aa32b014ce9", "comment": "Malware payload", "value": "2eb60b5e2f8c3e59136574a70cc115d8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618413386, "uuid": "7089df18-8e66-4ba3-91ed-9007413b4432", "comment": "Malware payload", "value": "fd8c95afd9ab5625a685eae15f74b44d8a728557b1bfb94e1cd209bcffcf50b3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618413386, "uuid": "eef9bd76-c22e-4e6d-9038-75148e4a3755", "comment": "Malware payload", "value": "f20e6a5794dfe589ae72eeebefdddf5d603609d4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618413386, "uuid": "9d8d603c-517a-4829-ba28-15f8496b7bf7", "comment": "Malware payload", "value": "8d6d353e8ac6206488d881edca5679f1e0f21b66f9c1b96e3123e6994be97a670ae223ca51d7f49423659be6f9d0232e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618413386, "uuid": "3c605592-9699-4e9e-a385-16436842b367", "value": "6A058E22B2805477D0AE0A389E6BB7B95C36FE006EE4544A77F8ED8C1F793903535296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618413386, "uuid": "9a32d633-25b7-4354-bf9a-08abe40bd8e1", "value": "12288:reLF/H+uJFLVETZPhyV9j5RfOWlW/o3auG+H9iKU/OyV:KLFf+iVETZPULzGWACafaUDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618413386, "uuid": "f6af8235-4033-4f27-9378-3efefcb20335", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618413386, "uuid": "f3e90cb9-8080-4362-9bb8-e34d278262cd", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618413386, "uuid": "db5eef08-03b8-4e20-ac65-af3261b34adf", "value": "Urgente RFQ_AP65425652_032421,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3f2c5f-9d44-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618420487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420487, "uuid": "f107c84e-3a35-4c7f-9fc0-7f96be426c6d", "comment": "Malware payload", "value": "4b9b682a2e9a524182520d3bf3b45171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420487, "uuid": "8a226ba5-c691-4a93-bb10-70e3d7e8c564", "comment": "Malware payload", "value": "fd8ef6a7f9226d7492407605a435cc04e3d6f680faa914126e966e4693987826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420487, "uuid": "b846927d-1e0d-4f2f-a075-62a1bebf9e3f", "comment": "Malware payload", "value": "51ccb30dec5113b0ac9bf873a90181055eff8359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618420487, "uuid": "f49929ba-fcab-40c3-af32-2eec6bb780cb", "comment": "Malware payload", "value": "a463acb3555272647794139af91eb1c47ccf8b7ab15014d831163443fd5953105877009de28c404ff9683fc0a23baebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420487, "uuid": "784f72d2-eb32-4f26-a0d2-507cb82e3f8d", "value": "1335BE5A23945F68F27EB7BA10351000A7F5F813D321EF1E3ED685DE0AA6F408656B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420487, "uuid": "839ec5ee-b288-4ac1-9ee0-cc964a1f445b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420487, "uuid": "15f6797d-4172-4704-b4a0-8cec80216b40", "value": "12288:vvQer02kBq4/Xk9UPicKF//YXjaKlFMHfmhyaP/OpOSYppP5IJb5fk0SZoWhEjng:vnys/IxM/6GABc5fkboUEj3h2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618420487, "uuid": "4e966573-9f8f-470f-bdba-d43b79e29b09", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618420487, "uuid": "a3e68861-973b-4290-9700-b55d4e799bf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618420487, "uuid": "eed930cc-c600-4475-b9be-b8fa907dfe8d", "value": "HL-88352588 DOCAU BC ORIGINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c888ef95-9d5e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618431598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431598, "uuid": "8c3962c9-4644-47aa-8ad9-09670cddba0b", "comment": "Malware payload", "value": "06c441fc0674121c5b57dcfc0f91d3fb", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431598, "uuid": "193493ab-7eaa-4e3e-8621-a0ff75e6a166", "comment": "Malware payload", "value": "fda62b3a3eed169cbf6e912d621b6bcc1d5bf3a35824c864ab2b8584e7960029", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431598, "uuid": "3ca21e03-e41a-46e1-b73e-72b8a5080a8c", "comment": "Malware payload", "value": "63d93d44fcaba27a9071d6063bab9a82344c1f0b", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618431598, "uuid": "ff1cec2d-ba68-47a9-8f88-b2cb8843cb18", "comment": "Malware payload", "value": "b94e980417bf511eba3de0e9e8e69dc8200ad02273f8ee246a6d12e8c977e7fb8cfd2b7b4ad6fba07e6ec0ca7d55da61", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431598, "uuid": "1e847669-4fc9-472e-9481-10f717be5b40", "value": "61249D8DCBB6D199F6E3EAF00082A36650A33D11056E1A9CEECC3B3F867F95C252555C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431598, "uuid": "ca807b33-c9da-43ef-89c8-a864a727825c", "value": "e39e4bc2a01a977f85e5be2edea20c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431598, "uuid": "3bf56e23-a80a-4737-b2eb-53f0e24eb7dc", "value": "3072:j0DpemgVst0qciSU12Eu/CSWznEeNd2LcT65hQt8Cz9B0k6Xq:CpepU127CjzEexUQSq9BH6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618431598, "uuid": "09b94d4e-f557-4bc0-9cc0-778f60aeca2f", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618431598, "uuid": "b19a577f-c856-4c08-82f7-e289de27338d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618431598, "uuid": "a211633f-57e9-4bdc-a39d-d1355a6af494", "value": "fda62b3a3eed169cbf6e912d621b6bcc1d5bf3a35824c864ab2b8584e7960029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c3fe68-9d30-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618411895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411895, "uuid": "1bfa98ed-7821-4102-a2cf-cf467e3098f4", "comment": "Malware payload", "value": "63e72f3de3bc324821158cb300d89f5d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411895, "uuid": "aaf1a8c3-5542-4a3d-9f12-bc699b0e2df3", "comment": "Malware payload", "value": "fe7a85b69c2e831563d9fd1be1a6e5434149d2568b5a584bddbc6425ef318c69", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411895, "uuid": "e64fe1df-777a-4730-af9a-012d648b8363", "comment": "Malware payload", "value": "a2d285aa68e772409d5df1b0b3dc29f5f769adec", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618411895, "uuid": "2e21adc6-3b76-4ee3-b248-27c43c477499", "comment": "Malware payload", "value": "c0adf5703ab2d1c448714d7473924ef97218e5f65d7be465c21876154c06549322cd670223189fc0d0f30caed540d60b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411895, "uuid": "24d8458d-ea11-41c4-917b-7a6fa77afaee", "value": "EED423A677C3A62BEE561D3015A2E7788BB3D20006B7560373FC2F5CE7639278A15784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411895, "uuid": "2b4104f0-c7d8-47e2-bf8d-067100fea901", "value": "12288:57kFAhHcVUyiqTS0Rjfmb9iv9qCzL1C/l:57kFAhHcyqTnN09qbC/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618411895, "uuid": "db74b1b2-b432-45b9-b23c-120ea2ac8d96", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618411895, "uuid": "8ec9a44a-01ea-4de7-8726-030e28fa05fc", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618411895, "uuid": "9aa892a7-006c-4da6-ab45-1e89e1a69ab1", "value": "PURCHASE ORDER-38052429.pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5603cd98-9d3f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618418091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418091, "uuid": "30151822-dab9-4cc0-817d-c0c14721b709", "comment": "Malware payload", "value": "941a89e11aa6590b9ec0421cee76ff2d", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418091, "uuid": "f2cb2848-0df9-4249-a6b4-89e96dd97ee6", "comment": "Malware payload", "value": "feda91b71de5aeb55262eff98db32d3c366d28e2b2ebb0f22edd52a225238bd9", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418091, "uuid": "e5e9c194-312e-4bd7-9f29-b2f4da95c980", "comment": "Malware payload", "value": "15884c965009100c8ecbf5055d851cb3bad22c32", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618418091, "uuid": "829fe037-1a08-469e-a011-0ce281a1e7d2", "comment": "Malware payload", "value": "6b96d61a360e60a64933c4b2a254111f3b85c1de7a4b05f0ab01b56d60e0b588de9fd773f1b172b61628ea121a717735", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418091, "uuid": "3713ae7e-a18f-4d9a-8f1c-ce58fa38c5e6", "value": "EAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418091, "uuid": "15333653-d783-4f7f-bc48-8a4c2dd74fc0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418091, "uuid": "217fb985-eb6d-463c-89e8-7ebd1c5bb411", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618418091, "uuid": "5f141f1a-a165-43c9-a099-4dec83a58509", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618418091, "uuid": "99586a62-4afb-4d70-9246-177d1087d748", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618418091, "uuid": "7288f225-8ee0-4ee5-985e-39db2b0384eb", "value": "feda91b71de5aeb55262eff98db32d3c366d28e2b2ebb0f22edd52a225238bd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abf7d6a-9cc6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618366211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618366211, "uuid": "3b03fc81-8775-4317-aacc-a869eaab2f38", "comment": "Malware payload (Loki)", "value": "ab6f7ae6b4ebf5aac9d14c3e1baba584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618366211, "uuid": "09cd9be2-0aa0-468d-a3d2-985328791998", "comment": "Malware payload (Loki)", "value": "fef13223324785a4193002ee4c1a7d93bc19c9c820592cca7fc63e2d382e1130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618366211, "uuid": "43c5fbe5-ca3b-4cca-afbd-c2da25670e84", "comment": "Malware payload (Loki)", "value": "b4cba23044f1aaa00ede58d20ddf0436abec940f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618366211, "uuid": "c0cfdc02-4efe-4a09-b240-2f5e84caac72", "comment": "Malware payload (Loki)", "value": "f75fee3ccf36c8453deae40e0717f9ce373f8e007fe2956eba1060ef752666d35ba70aa32af83dae0b25bf5b400eaaa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618366211, "uuid": "15889f17-b283-4c58-9d67-48b863474143", "value": "2BE30243B2F0AC37E74B99701DEB877AC7BE860A1010B24B8FE96F6FAD355408957146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618366211, "uuid": "32f9d838-01e3-4004-8824-2c00c3869eb3", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618366211, "uuid": "b6cf49cc-0d59-461d-bbdb-d814deb2b204", "value": "3072:HyewmN4skJ6KgivTwTVc3nwm/JbHWawE/D7tVZKS4AGtMWlV:Hd+gowTVcXwmRb2awE/D7zZKSWMWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618366211, "uuid": "30cf0bc1-984a-4fbb-948f-5f6ad1a130b7", "value": 149256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618366211, "uuid": "b6c22ac7-165b-43f0-9f3d-9aea9a2755ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618366211, "uuid": "b84b1d49-de63-41c7-aed6-d10e37f5db1a", "value": "Bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed46fac3-9d54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618427364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427364, "uuid": "43f69ae0-a428-4017-a2a3-3bd8606792cc", "comment": "Malware payload", "value": "ba46cbd4841e63e34d276fc575cfb514", "object_relation": "md5", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427364, "uuid": "084c7c64-a3bc-4e47-9695-bef3b69d5944", "comment": "Malware payload", "value": "ff28831ec02c96e719045e2fbcc4f169763c3f204e527b4cb276f023fd298781", "object_relation": "sha256", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427364, "uuid": "e351821c-ccbe-4fdf-81bb-e62c6619d9e4", "comment": "Malware payload", "value": "b7ce657af3f72d66bcbc8b2aac6397d3f69910e5", "object_relation": "sha1", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618427364, "uuid": "fde38ef6-8762-45d3-93be-45e780cd830a", "comment": "Malware payload", "value": "755feccced5b69e2248eb030b082287d5b9182745afdfe35b506f729dd7e4878259d64b60efd5dae06a059c256c72faf", "object_relation": "sha3-384", "Tag": [ { "name": "40111", "colour": "#7B75C4", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427364, "uuid": "ab88326e-61f2-4858-bb04-4b780e9b9483", "value": "97F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427364, "uuid": "28c4bcde-d18a-4ad3-b2c8-c41071d43693", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427364, "uuid": "a1745bd8-0899-4da7-b6ef-bedbf70fe0bb", "value": "3072:Plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618427364, "uuid": "397608a1-13a1-4f26-9c45-1f2142997ee1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618427364, "uuid": "e9c353cf-89e5-47ec-992d-e0eb4341b7b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618427364, "uuid": "8254bcef-19aa-46cd-b3f3-3f69eb772db8", "value": "ff28831ec02c96e719045e2fbcc4f169763c3f204e527b4cb276f023fd298781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b447a592-9ce1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618377877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377877, "uuid": "27038d94-64aa-4fc1-b616-60a420014b59", "comment": "Malware payload", "value": "0bb1df68dfdf9a1311562540a72dfe55", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "TSCookie", "colour": "#EB73A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377877, "uuid": "6615eb4a-331c-4d44-aea9-35c3425ac298", "comment": "Malware payload", "value": "ffe8d4f87b6e0e9166226ebf4836f50ecf771ced2d9509e572dc8013e359843c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "TSCookie", "colour": "#EB73A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377877, "uuid": "92fba152-1608-46db-aaa2-734b0c2ee691", "comment": "Malware payload", "value": "b1f42766b32cde7421349d6740c311915afd3cfb", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "TSCookie", "colour": "#EB73A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618377877, "uuid": "d72f9562-de17-4833-bf3f-bb78611bd901", "comment": "Malware payload", "value": "52e9b60818b050451c375015bd07df297350e9b2af854dbb60b4dce299818d08337452924858e7b955bf4dcad8a32d70", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BlackTech", "colour": "#863A8F", "exportable": true, "hide_tag": false }, { "name": "TSCookie", "colour": "#EB73A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377877, "uuid": "741d2ac5-8430-474b-b5ed-b75b4d98a13c", "value": "72057D1DF583A1F5C83744B0028BEB7F5A34E93580468DDBAD9DED39B8239E11A4D722", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377877, "uuid": "9dc447b2-5de4-449f-9db8-aac42645e892", "value": "24576:1+l4QUQhlbhRSCtYJJpJjqsGgse2NsOZjI:1TpQhlbhRSC6TvqKse2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618377877, "uuid": "feed781a-4bcb-49a9-8ffd-6a35ef9e9309", "value": 804348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618377877, "uuid": "b3ded06c-7976-4b0d-98e5-2e0e062ddb57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618377877, "uuid": "1c8047e4-a9b2-42b0-ba4b-6ec492a5c23f", "value": "ffe8d4f87b6e0e9166226ebf4836f50ecf771ced2d9509e572dc8013e359843c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ecc4a4-9d74-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618440819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440819, "uuid": "15798bb8-c514-4f72-974d-d52f36e06421", "comment": "Malware payload", "value": "9c1fd25a01b1e2fe4e28c737fed9e16a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440819, "uuid": "746a2b79-d516-40fd-ab72-63a8ce5d54a6", "comment": "Malware payload", "value": "fff65ba5ddb5f8501730253f1fe1617e37e8fbdb2b73a6b411a6418ff83ac8f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440819, "uuid": "801cd691-6cb6-4a6c-846c-56eed0ac4f26", "comment": "Malware payload", "value": "8aa80f9859c9450622775e3972ff3da63d7f01a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618440819, "uuid": "077566fd-06bb-488f-9fa0-aa61e06974fd", "comment": "Malware payload", "value": "19f7e9467a5ef1d286d2644187c30187dd50b029ab7b36a3d940bf39dc07b0931135e375785df94a1b17187dc51a9776", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440819, "uuid": "e14f226b-5e81-4bb6-bfad-91d595d8c5ea", "value": "BDE4336362543F8ADA0F6F3B35D01742BDABCE08D8681F5E46427676BF60BE14627708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440819, "uuid": "a9aec234-1ce5-499e-ae33-7bc11d277e47", "value": "12288:bvEXSIhEJHtnWS+F2c5U+60f3AzxYopprByMeMz3npAnTiB69ylRuMS48gWvS6C:b8XSUENtZW5U+VfcprBZz3inpfFgWvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618440819, "uuid": "9d22d8f1-5add-4a95-a903-5746554964df", "value": 694280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618440819, "uuid": "15cec1bf-7c4e-4638-b285-bc70c98d5e37", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618440819, "uuid": "c8948c9a-a0d2-4b9b-ad84-83edc940ba09", "value": "202104140012_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }